asda?â€°PNG IHDR ? f ??C1 sRGB ??Ã© gAMA Â±?Ã¼a pHYs ? ??oÂ¨d GIDATx^ÃÃ¼Lâ€Ã·eÃ·Y?a?("Bh?_Ã²???ï¿ Â§?q5k?*:t0A-o??ï¿¥]VkJï¿ M??f?Â±8\k2Ãllï¿¡1]q?Ã¹???T PKEhe[Åî#‚authcompat_ConfigSnippet.pynu„[µü¤# -*- coding: utf-8 -*- # # Authors: # Pavel BÅ™ezina # # Copyright (C) 2018 Red Hat # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import errno import os import re class ConfigSnippet: TEST = False AllKeysRE = re.compile(r'\${\??(?P[\w-]*)}') DummyKeysRE = re.compile(r'\${\?[\w-]*}') def __init__(self, template, destination): with open(template, "r") as f: self.template = f.read() self.destination = destination def generate(self, values): # First remove lines containing key that is not set lines = self.template.split('\n') remove = [] for idx, line in enumerate(lines): for match in self.AllKeysRE.finditer(line): key = match.group("key") if key not in values or values[key] is None: remove.append(idx) break for idx in sorted(remove, reverse=True): del lines[idx] # Build output string output = '\n'.join(lines) # Remove all dummy keys ${?key} output = self.DummyKeysRE.sub("", output) # Replace values for key, value in values.items(): if value is None: continue if type(value) is bool: value = "true" if value else "false" output = output.replace("${%s}" % key, value) return output def write(self, values, to_stdout=False): output = self.generate(values) if self.TEST: print("========== BEGIN Content of [%s] ==========" % self.destination) print(output) print("========== END Content of [%s] ==========\n" % self.destination) return dirname = os.path.dirname(self.destination) if not os.path.exists(dirname): try: os.makedirs(dirname) except OSError as exception: if exception.errno == errno.EEXIST and os.path.isdir(dirname): pass else: raise with open(self.destination, "w") as f: f.write(output) PKEhe[Ý›lÐ)V)V authcompat.pynuÈ¯Ýí#!/usr/libexec/platform-python # -*- coding: utf-8 -*- # # Authors: # Pavel BÅ™ezina # # Copyright (C) 2018 Red Hat # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import os import sys import locale import gettext import subprocess from authcompat_Options import Options from authcompat_EnvironmentFile import EnvironmentFile from authcompat_ConfigSnippet import ConfigSnippet _ = gettext.gettext def eprint(*args, **kwargs): print(*args, file=sys.stderr, **kwargs) class Command: TEST = False def __init__(self, command, args, input=None, check=True): self.args = [command] + args self.input = input.encode() if input is not None else None self.check = check self.result = None def run(self): print(_("Executing: %s") % ' '.join(self.args)) if self.TEST: return self.result = subprocess.run(self.args, check=self.check, input=self.input, stdout=subprocess.PIPE, stderr=subprocess.PIPE) class Service: def __init__(self, name): self.name = name + '.service' def runsystemd(self, command, required, enoent_code): try: command.run() except subprocess.CalledProcessError as result: if required and result.returncode == enoent_code: eprint(_("Service %s was not found. Please install the service.") % self.name) elif result.returncode != enoent_code: eprint(_("Command [%s] failed with %d, stderr:") % (' '.join(result.cmd), result.returncode)) eprint(result.stderr.decode()) def enable(self): cmd = Command(Path.System("cmd-systemctl"), ["enable", self.name]) self.runsystemd(cmd, True, 1) def disable(self): cmd = Command(Path.System("cmd-systemctl"), ["disable", self.name]) self.runsystemd(cmd, False, 1) def start(self, Restart=True): if Restart: self.stop() cmd = Command(Path.System("cmd-systemctl"), ["start", self.name]) self.runsystemd(cmd, True, 5) def stop(self): cmd = Command(Path.System("cmd-systemctl"), ["stop", self.name]) self.runsystemd(cmd, False, 5) class Path: LocalDir = os.path.dirname(os.path.realpath(__file__)) Config = EnvironmentFile(LocalDir + "/authcompat_paths") Files = { 'ldap.conf': '/etc/openldap/ldap.conf', 'krb5.conf': '/etc/krb5.conf.d/authconfig-krb.conf', 'sssd.conf': '/etc/sssd/conf.d/authconfig-sssd.conf', 'authconfig': '/etc/sysconfig/authconfig', 'network': '/etc/sysconfig/network', 'pwquality.conf': '/etc/security/pwquality.conf.d/10-authconfig-pwquality.conf', 'yp.conf': '/etc/yp.conf', 'cmd-systemctl': '/usr/bin/systemctl', 'cmd-authselect': '/usr/bin/authselect', 'cmd-realm': '/usr/sbin/realm', 'cmd-domainname': '/usr/bin/domainname', 'cmd-setsebool': '/usr/sbin/setsebool' } @staticmethod def Local(relpath): return "%s/%s" % (Path.LocalDir, relpath) @staticmethod def System(name): return Path.Files[name] class Configuration: class Base(object): def __init__(self, options, ServiceName=None): self.options = options self.service = None if ServiceName is not None: self.service = Service(ServiceName) def isEnabled(self): return True def isDisabled(self): return not self.isEnabled() def enableService(self, nostart): if self.service is None: return self.service.enable() if not nostart: self.service.start() def disableService(self, nostop): if self.service is None: return self.service.disable() if not nostop: self.service.stop() def cleanup(self): return def write(self): return def get(self, name): return self.options.get(name) def isset(self, name): return self.options.isset(name) def getTrueOrNone(self, name): return self.options.getTrueOrNone(name) def getBool(self, name): return self.options.getBool(name) def getBoolAsValue(self, name, if_true, if_false, AllowNone=False): if AllowNone and not self.isset(name): return None value = self.getBool(name) if value: return if_true return if_false def removeFile(self, filename): print(_("Removing file: %s") % filename) if self.options.getBool("test-call"): return try: os.remove(filename) except FileNotFoundError: return class LDAP(Base): def __init__(self, options): super(Configuration.LDAP, self).__init__(options) def write(self): config = EnvironmentFile(Path.System('ldap.conf'), " ", delimiter_re=r"\s\t", quotes=False) if self.isset("ldapserver"): config.set("URI", self.get("ldapserver")) if self.isset("ldapbasedn"): config.set("BASE", self.get("ldapbasedn")) config.write() class Kerberos(Base): def __init__(self, options): super(Configuration.Kerberos, self).__init__(options) def isEnabled(self): if not self.isset("krb5realm") and not self.isset("krb5realmdns"): return None return self.get("krb5realm") != "" or self.getBool("krb5realmdns") def cleanup(self): # Do not remove the file if these options are not set if not self.isset("krb5realm") and not self.isset("krb5realmdns"): return self.removeFile(Path.System('krb5.conf')) def write(self): if self.isDisabled(): return path = Path.Local("snippets/authconfig-krb.conf") config = ConfigSnippet(path, Path.System('krb5.conf')) realm = self.get("krb5realm") keys = { 'realm': self.get("krb5realm"), 'kdc-srv': self.get("krb5kdcdns"), 'realm-srv': self.get("krb5realmdns"), 'kdc': self.get("krb5kdc") if realm else None, 'adminserver': self.get("krb5adminserver") if realm else None, 'domain': realm.lower() if realm else None } config.write(keys) class Network(Base): def __init__(self, options): super(Configuration.Network, self).__init__(options) def write(self): nisdomain = self.get("nisdomain") config = EnvironmentFile(Path.System('network')) if nisdomain is None: return config.set("NISDOMAIN", nisdomain) config.write() class SSSD(Base): def __init__(self, options): super(Configuration.SSSD, self).__init__(options, ServiceName="sssd") def isEnabled(self): if not self.isset("ldap") and not self.isset("sssd"): return None return self.getBool("ldap") or self.getBool("sssd") def cleanup(self): self.removeFile(Path.System('sssd.conf')) def write(self): # Authconfig would not generate sssd in this case so we should not # either. Even if --enablesssd[auth] was provided the configuration # would not be generated. if not self.getBool("ldap"): return path = Path.Local("snippets/authconfig-sssd.conf") config = ConfigSnippet(path, Path.System('sssd.conf')) schema = "rfc2307bis" if self.getBool("rfc2307bis") else None keys = { 'ldap-uri': self.get("ldapserver"), 'ldap-basedn': self.get("ldapbasedn"), 'ldap-tls': self.getTrueOrNone("ldaptls"), 'ldap-schema': schema, 'krb5': self.getTrueOrNone("krb5"), 'kdc-uri': self.get("krb5kdc"), 'kpasswd-uri': self.get("krb5adminserver"), 'realm': self.get("krb5realm"), 'cache-creds': self.getTrueOrNone("cachecreds"), 'cert-auth': self.getTrueOrNone("smartcard") } config.write(keys) os.chmod(Path.System('sssd.conf'), mode=0o600) class Winbind(Base): def __init__(self, options): super(Configuration.Winbind, self).__init__(options, ServiceName="winbind") def isEnabled(self): if not self.isset("winbind") and not self.isset("winbindauth"): return None return self.getBool("winbind") or self.getBool("winbindauth") def write(self): if not self.isset("winbindjoin"): return creds = self.options.get("winbindjoin").split("%", 1) user = creds[0] password = None if len(creds) > 1: password = creds[1] + '\n' args = [ 'join', '-U', '"%s"' % user, '--client-software', 'winbind' ] if self.isset("smbworkgroup"): args.append(self.get("smbworkgroup")) cmd = Command(Path.System('cmd-realm'), args, input=password) try: cmd.run() except FileNotFoundError: eprint(_("%s was not found. Please, install realmd.") % Path.System('cmd-realm')) class PWQuality(Base): def __init__(self, options): super(Configuration.PWQuality, self).__init__(options) def write(self): config = EnvironmentFile(Path.System('pwquality.conf')) value_set = False pwopts = { "minlen": self.get("passminlen"), "minclass": self.get("passminclass"), "maxrepeat": self.get("passmaxrepeat"), "maxclassrepeat": self.get("passmaxclassrepeat"), "lcredit": self.getBoolAsValue("reqlower", -1, 0, AllowNone=True), "ucredit": self.getBoolAsValue("requpper", -1, 0, AllowNone=True), "dcredit": self.getBoolAsValue("reqdigit", -1, 0, AllowNone=True), "ocredit": self.getBoolAsValue("reqother", -1, 0, AllowNone=True) } # Write options only if their are actually set for opt, value in pwopts.items(): if value is not None: print(opt + "=" + str(value)) config.set(opt, value) value_set = True if value_set: config.write() class MakeHomedir(Base): def __init__(self, options): super(Configuration.MakeHomedir, self).__init__(options, ServiceName="oddjobd") def isEnabled(self): if not self.isset("mkhomedir"): return None return self.getBool("mkhomedir") def disableService(self, nostop): # Never disable the service in case it is already running as # other applications may depend on it. return class NIS(Base): def __init__(self, options): super(Configuration.NIS, self).__init__(options) self.rpcbind = Service("rpcbind") self.ypbind = Service("ypbind") def isEnabled(self): if not self.isset("nis"): return None return self.getBool("nis") def enableService(self, nostart): if not self.isset("nisdomain"): return nisdom = self.get("nisdomain") if not nostart: cmd = Command(Path.System('cmd-domainname'), [nisdom]) cmd.run() cmd = Command(Path.System('cmd-setsebool'), ['-P', 'allow_ypbind', '1']) cmd.run() self.rpcbind.enable() self.ypbind.enable() if not nostart: self.rpcbind.start(Restart=False) self.ypbind.start() def disableService(self, nostop): if not nostop: cmd = Command(Path.System('cmd-domainname'), ["(none)"]) cmd.run() cmd = Command(Path.System('cmd-setsebool'), ['-P', 'allow_ypbind', '0']) cmd.run() self.rpcbind.disable() self.ypbind.disable() if not nostop: self.rpcbind.stop() self.ypbind.stop() def write(self): if not self.isset("nisdomain"): return output = "domain " + self.get("nisdomain") additional_servers = [] if self.isset("nisserver"): servers = self.get("nisserver").split(",") additional_servers = servers[1:] output += " server " + servers[0] + "\n" else: output += " broadcast\n" for server in additional_servers: output += "ypserver " + server + "\n" filename = Path.System('yp.conf') if self.getBool("test-call"): print("========== BEGIN Content of [%s] ==========" % filename) print(output) print("========== END Content of [%s] ==========\n" % filename) return with open(filename, "w") as f: f.write(output) class AuthCompat: def __init__(self): self.sysconfig = EnvironmentFile(Path.System('authconfig')) self.options = Options() self.options.parse() self.options.applysysconfig(self.sysconfig) self.options.updatesysconfig(self.sysconfig) def printWarning(self): print(_("Running authconfig compatibility tool.")) print(_("The purpose of this tool is to enable authentication against " "chosen services with authselect and minimum configuration. " "It does not provide all capabilities of authconfig.\n")) print(_("IMPORTANT: authconfig is replaced by authselect, " "please update your scripts.")) print(_("See man authselect-migration(7) to help you with migration to authselect")) options = self.options.getSetButUnsupported() if options: print(_("Warning: These options are not supported anymore " "and have no effect:")) for name in options: print(" --%s" % name) print("") def printOptions(self): for option in Options.List: print("%s=%s" % (option.name, option.value)) def printSysconfig(self): for line in self.sysconfig.getall(): print("%s=%s" % (line.name, line.value)) def canContinue(self): disallowed = ["test", "probe", "restorebackup", "restorelastbackup"] required = ["update", "updateall", "kickstart"] if not self.options.getBool("test") and os.getuid() != 0: print(_("authconfig can only be run as root")) return False for option in disallowed: if self.options.getBool(option): print(_("Error: option --%s is no longer supported and we " "cannot continue if it is set." % option)) return False if self.options.getBool("winbind") != self.options.getBool("winbindauth"): print(_("Error: Both --enablewinbind and --enablewinbindauth must be set.")) return False # We require one of these options to perform changes # We encourage to use --updateall since we no longer support just pure # --update or --kickstart, they will act as --updateall. for option in required: if self.options.getBool(option): return True print(_("Error: Please, provide --updateall option.")) return False def runAuthselect(self): map = { 'smartcard': 'with-smartcard', 'requiresmartcard': 'with-smartcard-required', 'fingerprint': 'with-fingerprint', 'mkhomedir': 'with-mkhomedir', 'faillock': 'with-faillock', 'pamaccess': 'with-pamaccess', 'winbindkrb5': 'with-krb5' } # Read current configuration first. (profile, features) = self.getCurrentAuthselectConfig() # Change profile if requested. if (self.options.getBool("ldap") or self.options.getBool("ldapauth") or self.options.getBool("sssd") or self.options.getBool("sssdauth")): profile = "sssd" elif self.options.getBool("nis"): profile = "nis" elif self.options.getBool("winbind"): profile = "winbind" # Default to sssd if profile is None: profile = "sssd" # Add enabled and remove disabled features. for option, feature in map.items(): if not self.options.isset(option): continue enabled = self.options.getBool(option) if enabled: features.append(feature) else: while feature in features: features.remove(feature) # Add lock-on-smartcard-removal if requested if self.options.isset("smartcardaction"): if int(self.options.get("smartcardaction")) == 0: features.append("with-smartcard-lock-on-removal") else: features.remove("with-smartcard-lock-on-removal") # Remove duplicates. The order is not kept but that does not matter. features = list(set(features)) # Always run with --force. This is either first call of authconfig # in installation script or it is run on already configured system. # We want to use authselect in both cases anyway, since authconfig # would change the configuration either way. args = ["select", profile] args.extend(features) args.append("--force") cmd = Command(Path.System('cmd-authselect'), args) cmd.run() def getCurrentAuthselectConfig(self): cmd = Command(Path.System('cmd-authselect'), ['check'], check=False) cmd.run() if cmd.result is None or cmd.result.returncode != 0: return (None, []) cmd = Command(Path.System('cmd-authselect'), ['current', '--raw']) cmd.run() current = cmd.result.stdout.decode("utf-8").split() return (current[0], current[1:]) def writeConfiguration(self): configs = [ Configuration.LDAP(self.options), Configuration.Network(self.options), Configuration.Kerberos(self.options), Configuration.SSSD(self.options), Configuration.Winbind(self.options), Configuration.PWQuality(self.options), Configuration.MakeHomedir(self.options), Configuration.NIS(self.options) ] for config in configs: # Configuration decides if it needs to write something or not config.write() # Enable or disable service if needed nostart = self.options.getBool("nostart") try: enabled = config.isEnabled() # Skip service management if it can not be decided if enabled is None: continue if enabled: config.enableService(nostart) else: config.disableService(nostart) config.cleanup() except subprocess.CalledProcessError as result: # This is not fatal error. eprint(_("Command [%s] failed with %d, stderr:") % (' '.join(result.cmd), result.returncode)) eprint(result.stderr.decode()) def main(): try: locale.setlocale(locale.LC_ALL, '') except locale.Error: sys.stderr.write('Warning: Unsupported locale setting.\n') authcompat = AuthCompat() authcompat.printWarning() Command.TEST = authcompat.options.getBool("test-call") EnvironmentFile.TEST = authcompat.options.getBool("test-call") ConfigSnippet.TEST = authcompat.options.getBool("test-call") if not authcompat.canContinue(): sys.exit(1) try: authcompat.runAuthselect() authcompat.writeConfiguration() authcompat.sysconfig.write() except subprocess.CalledProcessError as result: eprint(_("Command [%s] failed with %d, stderr:") % (' '.join(result.cmd), result.returncode)) eprint(result.stderr.decode()) sys.exit(0) if __name__ == "__main__": main() PKEhe[ªOLLauthcompat_EnvironmentFile.pynu„[µü¤# -*- coding: utf-8 -*- # # Authors: # Pavel BÅ™ezina # # Copyright (C) 2018 Red Hat # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import errno import os import re class EnvironmentFile: TEST = False def __init__(self, filename, delimiter='=', delimiter_re=None, quotes=True): self.filename = filename self.delimiter = delimiter self.quotes = quotes self.environment = [] delimiter_re = delimiter_re if delimiter_re is not None else delimiter self.pattern = re.compile(r'^(\s*)(\S*)([^\n\S]*)(' + delimiter_re + r')([^\n\S]*)(.*)$', re.MULTILINE) self.read() def read(self): try: with open(self.filename, "r") as f: lines = f.readlines() except FileNotFoundError: return for line in lines: parsed = self.Line.Parse(line, self.pattern, self.delimiter, self.quotes) self.environment.append(parsed) def write(self): output = "" for line in self.environment: output = output + line.getLine() if self.TEST: print("========== BEGIN Content of [%s] ==========" % self.filename) print(output) print("========== END Content of [%s] ==========\n" % self.filename) return dirname = os.path.dirname(self.filename) if not os.path.exists(dirname): try: os.makedirs(dirname) except OSError as exception: if exception.errno == errno.EEXIST and os.path.isdir(dirname): pass else: raise with open(self.filename, "w") as f: f.write(output) def get(self, name, default=None): value = None for line in self.environment: if line.isVariable() and line.name == name: value = line.value if value is None: return default if value.lower() in [None, "no", "false", "f", "n"]: return False elif value.lower() in ["yes", "true", "t", "y"]: return True return value def getall(self): lines = [] for line in self.environment: if line.isVariable(): lines.append(line) return lines def set(self, name, value): if type(value) is bool: value = "yes" if value else "no" for line in self.environment: if line.isVariable() and line.name == name: line.set(name, value) return line = self.Line(self.delimiter, self.quotes) line.set(name, value) self.environment.append(line) class Line: def __init__(self, delimiter, quotes, name=None, value=None, original=None, fmt=None): self.delimiter = delimiter self.quotes = quotes self.name = name self.value = value self.original = original self.fmt = fmt def isVariable(self): return self.fmt is not None def isOriginal(self): return self.original is not None def set(self, name, value): self.name = name self.value = value if self.fmt is None: self.fmt = "${name}%s${value}\n" % self.delimiter def getLine(self): if self.isOriginal(): return self.original value = self.value if self.value is not None else "" replacement = { 'name': self.name, 'value': self.Escape(value, self.quotes) } line = self.fmt for key, value in replacement.items(): line = line.replace("${" + key + "}", str(value)) return line @staticmethod def Parse(line, pattern, delimiter, quotes): match = pattern.match(line) if line.startswith('#') or not line.strip() or not match: return EnvironmentFile.Line(delimiter, quotes, original=line) name = match.group(2) value = EnvironmentFile.Line.Unescape(match.group(6), quotes) fmt = "%s${name}%s%s%s${value}\n" % (match.group(1), match.group(3), match.group(4), match.group(5)) return EnvironmentFile.Line(delimiter, quotes, name=name, value=value, fmt=fmt) @staticmethod def Escape(value, quotes): if value is None: return "" value = str(value) value = value.replace("\\", "\\\\") value = value.replace("\"", "\\\"") value = value.replace("'", "\\\'") value = value.replace("$", "\\$") value = value.replace("~", "\\~") value = value.replace("`", "\\`") if quotes: if value.find(" ") > 0 or value.find("\t") > 0: value = "\"" + value + "\"" return value @staticmethod def Unescape(value, quotes): if not value: return value value = str(value) length = len(value) if quotes: if (value[0] == "\"" or value[0] == "'") and value[0] == value[length - 1]: value = value[1:length - 1] i = 0 while True: i = value.find("\\", i) if i < 0: break if i + 1 >= len(value): value = value[0:i] break value = value[0:i] + value[i + 1:] i += 1 return value PKEhe[2sŠèöösnippets/authconfig-krb.confnu„[µü¤[libdefaults] dns_lookup_kdc = ${kdc-srv} dns_lookup_realm = ${realm-srv} default_realm = ${realm} [realms] ${realm} = { kdc = ${kdc} admin_server = ${adminserver} ${?realm}} [domain_realm] ${domain} = ${realm} .${domain} = ${realm} PKEhe[26ÒÒsnippets/authconfig-sssd.confnu„[µü¤[sssd] domains = default [domain/default] id_provider = ldap auth_provider${?krb5} = krb5 ldap_uri = ${ldap-uri} ldap_search_base = ${ldap-basedn} ldap_id_use_start_tls = ${ldap-tls} ldap_schema = ${ldap-schema} krb5_server${?krb5} = ${kdc-uri} krb5_kpasswd${?krb5} = ${kpasswd-uri} krb5_realm${?krb5} = ${realm} krb5_store_password_if_offline${?krb5} = ${cache-credentials} cache_credentials = ${cache-credentials} [pam]${?cert-auth} pam_cert_auth = ${cert-auth} PKEhe[˜Ès"9__pycache__/authcompat_ConfigSnippet.cpython-36.opt-1.pycnu„[µü¤3 Ù¥ˆcã@s*ddlZddlZddlZGdd„dƒZdS)éNc@s>eZdZdZejdƒZejdƒZdd„Zdd„Z ddd „Z d S)Ú ConfigSnippetFz\${\??(?P[\w-]*)}z\${\?[\w-]*}c Cs*t|dƒ}|jƒ|_WdQRX||_dS)NÚr)ÚopenÚreadÚtemplateÚdestination)ÚselfrrÚf©r ú./usr/lib/python3.6/authcompat_ConfigSnippet.pyÚ__init__!szConfigSnippet.__init__c Csæ|jjdƒ}g}xTt|ƒD]H\}}x>|jj|ƒD].}|jdƒ}||ksR||dkr0|j|ƒPq0WqWxt|ddD] }||=qtWdj|ƒ}|j j d|ƒ}xF|jƒD]:\}} | dkr¶q¤t| ƒt krÎ| rÊdnd} |jd|| ƒ}q¤W|S) NÚ ÚkeyT)ÚreverseÚÚtrueZfalsez${%s})rÚsplitÚ enumerateÚ AllKeysREÚfinditerÚgroupÚappendÚsortedÚjoinÚDummyKeysREÚsubÚitemsÚtypeÚboolÚreplace) rÚvaluesÚlinesÚremoveÚidxÚlineÚmatchrÚoutputÚvaluer r rÚgenerate's& zConfigSnippet.generatecCsÆ|j|ƒ}|jr8td|jƒt|ƒtd|jƒdStjj|jƒ}tjj|ƒs ytj|ƒWn>t k rž}z"|j t jkrŒtjj|ƒrŒn‚WYdd}~XnXt |jdƒ}|j|ƒWdQRXdS)Nz+========== BEGIN Content of [%s] ==========z,========== END Content of [%s] ========== Úw)r(ÚTESTÚprintrÚosÚpathÚdirnameÚexistsÚmakedirsÚOSErrorÚerrnoZEEXISTÚisdirrÚwrite)rr Z to_stdoutr&r.Z exceptionr r r rr4Hs zConfigSnippet.writeN)F)Ú__name__Ú __module__Ú__qualname__r*ÚreÚcompilerrrr(r4r r r rrs !r)r2r,r8rr r r rÚsPKEhe[‚¦àÚ'Ú'-__pycache__/authcompat_Options.cpython-36.pycnu„[µü¤3 [Ø*e¬6ã@s6ddlZddlZejZGdd„dƒZGdd„dƒZdS)éNc@steZdZdd„Zdd„Zdd„Zdd„Zed d „ƒZedd„ƒZ ed d„ƒZ edd„ƒZedd„ƒZedd„ƒZ dS)ÚOptioncCs.||_||_||_||_||_d|_d|_dS)NF)ÚnameÚmetavarÚhelpÚfeatureÚ supportedÚvalueÚfrom_sysconfig)Úselfrrrrr©rú(/usr/lib/python3.6/authcompat_Options.pyÚ__init__szOption.__init__cCs ||_dS)N)r)r Ú new_valuerrrÚset&sz Option.setcCs|j|ƒd|_dS)NT)rr )r rrrrÚset_from_sysconfig)s zOption.set_from_sysconfigcCs |jdk S)N)r)r rrrÚisset-szOption.issetcCst|||dddS)NFT)rr)r)rrrrrrÚValued0sz Option.ValuedcCst|d|dddS)NFT)rr)r)rrrrrÚSwitch4sz Option.SwitchcCst|d|dddS)NT)rr)r)rrrrrÚFeature8szOption.FeaturecCst||ddddS)NF)rr)r)rrrrrÚUnsupportedValued<szOption.UnsupportedValuedcCst|dddddS)NTF)rr)r)rrrrÚUnsupportedFeature@szOption.UnsupportedFeaturecCst|dddddS)NF)rr)r)rrrrÚUnsupportedSwitchDszOption.UnsupportedSwitchN)Ú__name__Ú __module__Ú__qualname__r rrrÚstaticmethodrrrrrrrrrrrs rcM@sºeZdZejdedƒƒejdedƒedƒƒejdedƒedƒƒejd ed ƒƒejdedƒƒejd edƒedƒƒejdedƒedƒƒejdedƒƒejdedƒƒejdedƒƒejdedƒƒejdedƒedƒƒejdedƒƒejded ƒƒejd!ed"ƒƒejd#edƒed$ƒƒejd%edƒed&ƒƒejd'ed(ƒed)ƒƒejd*ed+ƒƒejd,ed-ƒƒejd.ed/ƒƒejd0ed1ƒƒejd2ed3ƒed4ƒƒejd5ed6ƒƒejd7ed8ƒed9ƒƒejd:ed;ƒƒejded?ƒƒejd@edAƒƒejdBedCƒƒejdDedEƒƒejdFedGƒedHƒƒejdIedGƒedJƒƒejdKedGƒedLƒƒejdMedGƒedNƒƒejdOedPƒƒejdQedRƒƒejdSedTƒƒejdUedVƒƒejdWedXƒƒejdYedZƒƒejd[ed\ƒƒejd]ed\ƒƒejd^ej ƒej d_ƒej d`ƒejdaedbƒƒejdcedbƒƒej ddƒejdeƒejdfƒejdgƒej dhƒejdiƒej djƒejdkedlƒƒejdmednƒƒejdoedpƒƒejdqedrƒƒejdsed(ƒƒejdteduƒƒejdvedwƒƒejdxedwƒƒejdyedwƒƒejdzed{ƒƒejd|ed}ƒƒejd~edƒƒejd€ƒejdƒejd‚ƒejdƒƒejd„ƒejd…ƒejd†ed‡ƒƒgJZ dDd†d ddfd.d5d:d!dddddkdidgd0ddˆœZd‰dŠ„Zd‹dŒ„ZddŽ„Zdd„Zd‘d’„Zd“d”„Zd•d–„Zd—d˜„Zd™dš„Zd›dœ„Zddž„ZdŸd „Zd¡d¢„Zd£d¤„Zd¥S)¦ÚOptionsZnisz#NIS for user information by defaultZ nisdomainzzdefault NIS domainZ nisserverzzdefault NIS serverZldapz$LDAP for user information by defaultZldapauthz"LDAP for authentication by defaultZ ldapserverz#default LDAP server hostname or URIZ ldapbasednzzdefault LDAP base DNÚldaptlszuse of TLS with LDAP (RFC-2830)Úldapstarttlsz4use of TLS for identity lookups with LDAP (RFC-2830)Z rfc2307bisz;use of RFC-2307bis schema for LDAP user information lookupsZ smartcardz)authentication with smart card by defaultZsmartcardactionz<0=Lock|1=Ignore>z(action to be taken on smart card removalZrequiresmartcardz0require smart card for authentication by defaultZfingerprintz2authentication with fingerprint readers by defaultZkrb5z"Kerberos authentication by defaultZkrb5kdczdefault Kerberos KDCZkrb5adminserverzdefault Kerberos admin serverZ krb5realmzzdefault Kerberos realmZ krb5kdcdnsz use of DNS to find Kerberos KDCsZkrb5realmdnsz"use of DNS to find Kerberos realmsZwinbindz'winbind for user information by defaultZwinbindauthz%winbind for authentication by defaultZwinbindjoinzz>join the winbind domain or ads realm now as this administratorZwinbindkrb5z(Kerberos 5 for authenticate with winbindZsmbworkgroupzz'workgroup authentication servers are inZsssdzHSSSD for user information by default with manually managed configurationZsssdauthzFSSSD for authentication by default with manually managed configurationZ cachecredsz.caching of user credentials in SSSD by defaultZ pamaccessz1check of access.conf during account authorizationZ mkhomedirz;creation of home directories for users on their first loginZfaillockzGaccount locking in case of too many consecutive authentication failuresZ passminlenzzminimum length of a passwordZpassminclassz1minimum number of character classes in a passwordZ passmaxrepeatz;maximum number of same consecutive characters in a passwordZpassmaxclassrepeatzDmaximum number of consecutive characters of same class in a passwordZreqlowerz6require at least one lowercase character in a passwordZrequpperz6require at least one uppercase character in a passwordZreqdigitz(require at least one digit in a passwordZreqotherz2require at least one other character in a passwordZnostartzdo not start/stop servicesZ updateallzupdate all configuration filesÚupdatezthe same as --updateallZ kickstartz test-callZtestZprobeZ savebackupzZ restorebackupZrestorelastbackupÚcacheZecryptfsÚshadowÚ useshadowÚmd5Úusemd5Zpassalgoz%ZldaploadcacertzZsmartcardmodulezZsmbsecurityzZsmbrealmZ smbserversz Z smbidmaprangezZsmbidmapuidZsmbidmapgidZwinbindseparatorz<\>Zwinbindtemplatehomedirz ZwinbindtemplateshellzZwinbindusedefaultdomainZwinbindofflineZ preferdnsZforcelegacyZlocauthorizeZ sysnetauthZfaillockargsz )ZUSEFAILLOCKZFAILLOCKARGSZUSELDAPZUSENISZUSEECRYPTFSZ USEWINBINDZWINBINDKRB5ZUSESSSDZUSEKERBEROSZUSELDAPAUTHZUSESMARTCARDZFORCESMARTCARDZ USEFPRINTDZPASSWDALGORITHMZUSEMD5Z USESHADOWZUSEWINBINDAUTHZUSESSSDAUTHZUSELOCAUTHORIZEZUSEPAMACCESSZUSEMKHOMEDIRZ USESYSNETAUTHZFORCELEGACYZCACHECREDENTIALScCs&i|_x|jD]}||j|j<qWdS)N)ÚoptionsÚListr)r Úoptionrrrr ÈszOptions.__init__cCs tjdd}|jtdƒƒ|jtdƒƒdœ}x,|jD]"}|jr@dnd}|j|||ƒq2W|jƒ}x*|jj ƒD]\}}t ||ƒ}|j|ƒqlW|jdƒr´|jd ƒr´|jd|j d ƒƒ|jd ƒrÜ|jdƒrÜ|jd |j dƒƒ|jdƒoð|jd ƒr|jd |j dƒƒdS)NzAuthconfig Compatibility Tool.)Údescriptionz(These options have a compatibility layerz8These options are no longer supported and have no effect)rÚunsupportedrr)r#r$r!r"rr)ÚargparseÚArgumentParserZadd_argument_groupÚ_r&rÚ add_optionÚ parse_argsr%ÚitemsÚgetattrrrÚget)r ÚparserZparsersr'ÚgroupZcmdlinerrrrrÚparseÎs z Options.parsecCs<x6|jjƒD](\}}|j|ƒs|j|j|j|ƒƒqWdS)N)ÚMapr/rr%rr1)r Ú sysconfigrr'rrrÚapplysysconfigës zOptions.applysysconfigcCs8x2|jjƒD]$\}}|j|ƒr|j||j|ƒƒqWdS)N)r5r/rrr1)r r6rr'rrrÚupdatesysconfigðs zOptions.updatesysconfigcCs|j|jS)N)r%r)r rrrrr1õszOptions.getcCs|j|j|ƒdS)N)r%r)r rrrrrrøszOptions.setcCs|j|jƒS)N)r%r)r rrrrrûsz Options.issetcCs |j|ƒ}|dks|rdSdS)NFT)r1)r rrrrrÚgetBoolþs zOptions.getBoolcCs |j|ƒ}|dks|rdSdS)NT)r1)r rrrrrÚ getTrueOrNones zOptions.getTrueOrNonecCs^g}xTtjD]J}|jrq|jƒs"q|jr*q|j}|jrL|jrDd|nd|}|j|ƒqW|S)NÚenableÚdisable) rr&rrr rrrÚappend)r r%r'rrrrÚgetSetButUnsupported szOptions.getSetButUnsupportedcCs<|jdk r|j||ƒn |jr,|j||ƒn|j||ƒdS)N)rÚ add_valuedrÚadd_featureÚ add_switch)r r2r'rrrr-s zOptions.add_optioncCs$|jd|jd|j|j|jddS)Nz--Zstore)ÚactionrÚdestr)Úadd_argumentrrr)r r2r'rrrr?&s zOptions.add_valuedcCs"|jd|jdd|j|jddS)Nz--Ústore_constT)rBÚconstrrC)rDrr)r r2r'rrrrA-s zOptions.add_switchcCsrd}d}|jdk r6tdƒd|j}tdƒd|j}|jd|jdd||jd|jd|jdd ||jddS) Nr;ú r<z--enablerET)rBrFrrCz --disableF)rr,rDr)r r2r'Zhelp_enableZhelp_disablerrrr@4s zOptions.add_featureN)rrrrrr,rrr*ZSUPPRESSrrrr&r5r r4r7r8r1rrr9r:r>r-r?rAr@rrrrrIsà r)r*Úgettextr,rrrrrrÚs-PKEhe[êâðÐcc5__pycache__/authcompat_EnvironmentFile.cpython-36.pycnu„[µü¤3 Ù¥ˆcLã@s*ddlZddlZddlZGdd„dƒZdS)éNc@sReZdZdZddd„Zdd„Zd d „Zddd„Zd d„Zdd„Z Gdd„dƒZ dS)ÚEnvironmentFileFú=NTcCsL||_||_||_g|_|dk r$|n|}tjd|dtjƒ|_|jƒdS)Nz^(\s*)(\S*)([^\n\S]*)(z)([^\n\S]*)(.*)$) ÚfilenameÚ delimiterÚquotesÚenvironmentÚreÚcompileÚ MULTILINEÚpatternÚread)ÚselfrrZdelimiter_rer©rú0/usr/lib/python3.6/authcompat_EnvironmentFile.pyÚ__init__s zEnvironmentFile.__init__cCspy$t|jdƒ}|jƒ}WdQRXWntk r8dSXx0|D](}|jj||j|j|jƒ}|j j |ƒq@WdS)NÚr)ÚopenrÚ readlinesÚFileNotFoundErrorÚLineÚParserrrrÚappend)r ÚfÚlinesÚlineZparsedrrrr.s zEnvironmentFile.readcCsÜd}x|jD]}||jƒ}qW|jrNtd|jƒt|ƒtd|jƒdStjj|jƒ}tjj|ƒs¶ytj |ƒWn>t k r´}z"|jtjkr¢tjj |ƒr¢n‚WYdd}~XnXt|jdƒ}|j|ƒWdQRXdS)NÚz+========== BEGIN Content of [%s] ==========z,========== END Content of [%s] ========== Úw)rÚgetLineÚTESTÚprintrÚosÚpathÚdirnameÚexistsÚmakedirsÚOSErrorÚerrnoZEEXISTÚisdirrÚwrite)r Úoutputrr"Z exceptionrrrrr(:s$zEnvironmentFile.writecCs\d}x&|jD]}|jƒr|j|kr|j}qW|dkr8|S|jƒdkrHdS|jƒdkrXd S|S) NÚnoÚfalserÚnFÚyesÚtrueÚtÚyT)Nr*r+rr,)r-r.r/r0)rÚ isVariableÚnameÚvalueÚlower)r r2Údefaultr3rrrrÚgetRs zEnvironmentFile.getcCs*g}x |jD]}|jƒr|j|ƒqW|S)N)rr1r)r rrrrrÚgetallbs zEnvironmentFile.getallcCsvt|ƒtkr|rdnd}x0|jD]&}|jƒr |j|kr |j||ƒdSq W|j|j|jƒ}|j||ƒ|jj |ƒdS)Nr-r*) ÚtypeÚboolrr1r2Úsetrrrr)r r2r3rrrrr:jszEnvironmentFile.setc@sZeZdZddd„Zdd„Zdd„Zdd „Zd d„Zedd „ƒZ edd„ƒZ edd„ƒZdS)zEnvironmentFile.LineNcCs(||_||_||_||_||_||_dS)N)rrr2r3ÚoriginalÚfmt)r rrr2r3r;r<rrrrxszEnvironmentFile.Line.__init__cCs |jdk S)N)r<)r rrrr1szEnvironmentFile.Line.isVariablecCs |jdk S)N)r;)r rrrÚ isOriginal„szEnvironmentFile.Line.isOriginalcCs&||_||_|jdkr"d|j|_dS)Nz${name}%s${value} )r2r3r<r)r r2r3rrrr:‡s zEnvironmentFile.Line.setcCsp|jƒr|jS|jdk r|jnd}|j|j||jƒdœ}|j}x,|jƒD] \}}|jd|dt |ƒƒ}qHW|S)Nr)r2r3z${ú}) r=r;r3r2ÚEscaperr<ÚitemsÚreplaceÚstr)r r3ZreplacementrÚkeyrrrrszEnvironmentFile.Line.getLinecCsŽ|j|ƒ}|jdƒs$|jƒs$|r4tj|||dS|jdƒ}tjj|jdƒ|ƒ}d|jdƒ|jdƒ|jdƒ|jd ƒf}tj|||||d S)Nú#)r;ééz%s${name}%s%s%s${value} éééé)r2r3r<)ÚmatchÚ startswithÚstriprrÚgroupÚUnescape)rrrrrKr2r3r<rrrrs zEnvironmentFile.Line.ParsecCsŒ|dkrdSt|ƒ}|jddƒ}|jddƒ}|jddƒ}|jdd ƒ}|jd dƒ}|jdd ƒ}|rˆ|jdƒdks||jdƒdkrˆd|d}|S)Nrú\z\\ú"z\"ú'z\'ú$z\$ú~z\~ú`z\`ú rú )rBrAÚfind)r3rrrrr?szEnvironmentFile.Line.EscapecCs¾|s|St|ƒ}t|ƒ}|rX|ddks4|ddkrX|d||dkrX|d|d…}d}x\|jd|ƒ}|dkrtP|dt|ƒkr’|d|…}P|d|…||dd…}|d7}q^W|S)NrrQrRrGrP)rBÚlenrX)r3rZlengthÚirrrrOÀs$,zEnvironmentFile.Line.Unescape)NNNN)Ú__name__Ú __module__Ú__qualname__rr1r=r:rÚstaticmethodrr?rOrrrrrws r)rNT)N)r[r\r]rrrr(r6r7r:rrrrrrs r)r&r rrrrrrÚsPKEhe[ü¿À¬´M´M+__pycache__/authcompat.cpython-36.opt-1.pycnu„[µü¤3 ŸØ*e)Vã@sºddlZddlZddlZddlZddlZddlmZddlmZddl m Z ejZdd„ZGdd„dƒZ Gd d „d ƒZGdd„dƒZGd d„dƒZGdd„dƒZdd„Zedkr¶eƒdS)éN)ÚOptions)ÚEnvironmentFile)Ú ConfigSnippetcOst|dtji|—ŽdS)NÚfile)ÚprintÚsysÚstderr)ÚargsÚkwargs©rú /usr/lib/python3.6/authcompat.pyÚeprint%sr c@s"eZdZdZddd„Zdd„ZdS) ÚCommandFNTcCs2|g||_|dk r|jƒnd|_||_d|_dS)N)r ÚencodeÚinputÚcheckÚresult)ÚselfÚcommandr rrrrrÚ__init__,szCommand.__init__cCsFttdƒdj|jƒƒ|jr"dStj|j|j|jtj tj d|_ dS)Nz Executing: %sú )rrÚstdoutr)rÚ_Újoinr ÚTESTÚ subprocessÚrunrrÚPIPEr)rrrrr2szCommand.run)NT)Ú__name__Ú __module__Ú__qualname__rrrrrrrr)s rc@s>eZdZdd„Zdd„Zdd„Zdd„Zdd d„Zdd „ZdS)ÚServicecCs|d|_dS)Nz.service)Úname)rr"rrrr?szService.__init__cCsŽy|jƒWn|tjk rˆ}z^|rB|j|krBttdƒ|jƒn6|j|krxttdƒdj|jƒ|jfƒt|j j ƒƒWYdd}~XnXdS)Nz5Service %s was not found. Please install the service.z$Command [%s] failed with %d, stderr:r)rrÚCalledProcessErrorÚ returncoder rr"rÚcmdrÚdecode)rrÚrequiredZenoent_coderrrrÚ runsystemdBs zService.runsystemdcCs(ttjdƒd|jgƒ}|j|ddƒdS)Nz cmd-systemctlÚenableTé)rÚPathÚSystemr"r()rr%rrrr)NszService.enablecCs(ttjdƒd|jgƒ}|j|ddƒdS)Nz cmd-systemctlÚdisableFr*)rr+r,r"r()rr%rrrr-RszService.disableTcCs4|r|jƒttjdƒd|jgƒ}|j|ddƒdS)Nz cmd-systemctlÚstartTé)Ústoprr+r,r"r()rÚRestartr%rrrr.Vsz Service.startcCs(ttjdƒd|jgƒ}|j|ddƒdS)Nz cmd-systemctlr0Fr/)rr+r,r"r()rr%rrrr0\szService.stopN)T) rrr rr(r)r-r.r0rrrrr!>s r!c @sbeZdZejjejjeƒƒZe edƒZ dddddddd d ddd dœZedd„ƒZ edd„ƒZdS)r+z/authcompat_pathsz/etc/openldap/ldap.confz$/etc/krb5.conf.d/authconfig-krb.confz%/etc/sssd/conf.d/authconfig-sssd.confz/etc/sysconfig/authconfigz/etc/sysconfig/networkz;/etc/security/pwquality.conf.d/10-authconfig-pwquality.confz/etc/yp.confz/usr/bin/systemctlz/usr/bin/authselectz/usr/sbin/realmz/usr/bin/domainnamez/usr/sbin/setsebool)z ldap.confz krb5.confz sssd.confÚ authconfigÚnetworkzpwquality.confzyp.confz cmd-systemctlzcmd-authselectz cmd-realmzcmd-domainnamez cmd-setseboolcCsdtj|fS)Nz%s/%s)r+ÚLocalDir)ÚrelpathrrrÚLocaltsz Path.LocalcCs tj|S)N)r+ÚFiles)r"rrrr,xszPath.SystemN)rrr ÚosÚpathÚdirnameÚrealpathÚ__file__r4rZConfigr7Ústaticmethodr6r,rrrrr+as r+c@sœeZdZGdd„deƒZGdd„deƒZGdd„deƒZGdd„deƒZGd d „d eƒZGdd„deƒZ Gd d„deƒZ Gdd„deƒZGdd„deƒZdS)Ú Configurationc@sxeZdZddd„Zdd„Zdd„Zdd „Zd d„Zdd „Zdd„Z dd„Z dd„Zdd„Zdd„Z ddd„Zdd„ZdS)zConfiguration.BaseNcCs"||_d|_|dk rt|ƒ|_dS)N)ÚoptionsÚservicer!)rr?ÚServiceNamerrrrszConfiguration.Base.__init__cCsdS)NTr)rrrrÚ isEnabled…szConfiguration.Base.isEnabledcCs |jƒS)N)rB)rrrrÚ isDisabledˆszConfiguration.Base.isDisabledcCs*|jdkrdS|jjƒ|s&|jjƒdS)N)r@r)r.)rÚnostartrrrÚ enableService‹s z Configuration.Base.enableServicecCs*|jdkrdS|jjƒ|s&|jjƒdS)N)r@r-r0)rÚnostoprrrÚdisableService”s z!Configuration.Base.disableServicecCsdS)Nr)rrrrÚcleanupszConfiguration.Base.cleanupcCsdS)Nr)rrrrÚwrite szConfiguration.Base.writecCs|jj|ƒS)N)r?Úget)rr"rrrrJ£szConfiguration.Base.getcCs|jj|ƒS)N)r?Úisset)rr"rrrrK¦szConfiguration.Base.issetcCs|jj|ƒS)N)r?Ú getTrueOrNone)rr"rrrrL©sz Configuration.Base.getTrueOrNonecCs|jj|ƒS)N)r?ÚgetBool)rr"rrrrM¬szConfiguration.Base.getBoolFcCs*|r|j|ƒrdS|j|ƒ}|r&|S|S)N)rKrM)rr"Zif_trueZif_falseÚ AllowNoneÚvaluerrrÚgetBoolAsValue¯s z!Configuration.Base.getBoolAsValuecCsHttdƒ|ƒ|jjdƒr dSytj|ƒWntk rBdSXdS)NzRemoving file: %sz test-call)rrr?rMr8ÚremoveÚFileNotFoundError)rÚfilenamerrrÚ removeFile¹szConfiguration.Base.removeFile)N)F)rrr rrBrCrErGrHrIrJrKrLrMrPrTrrrrÚBase~s rUcs$eZdZ‡fdd„Zdd„Z‡ZS)zConfiguration.LDAPcsttj|ƒj|ƒdS)N)Úsuperr>ÚLDAPr)rr?)Ú __class__rrrÄszConfiguration.LDAP.__init__cCsZttjdƒdddd}|jdƒr2|jd|jdƒƒ|jdƒrN|jd |jdƒƒ|jƒdS) Nz ldap.confrz\s\tF)Zdelimiter_reZquotesÚ ldapserverZURIÚ ldapbasednZBASE)rr+r,rKÚsetrJrI)rÚconfigrrrrIÇs zConfiguration.LDAP.write)rrr rrIÚ __classcell__rr)rXrrWÃsrWcs4eZdZ‡fdd„Zdd„Zdd„Zdd„Z‡ZS) zConfiguration.Kerberoscsttj|ƒj|ƒdS)N)rVr>ÚKerberosr)rr?)rXrrrÓszConfiguration.Kerberos.__init__cCs4|jdƒr|jdƒrdS|jdƒdkp2|jdƒS)NÚ krb5realmÚkrb5realmdnsÚ)rKrJrM)rrrrrBÖsz Configuration.Kerberos.isEnabledcCs0|jdƒr|jdƒrdS|jtjdƒƒdS)Nr_r`z krb5.conf)rKrTr+r,)rrrrrHÜszConfiguration.Kerberos.cleanupcCsŠ|jƒrdStjdƒ}t|tjdƒƒ}|jdƒ}|jdƒ|jdƒ|jdƒ|rV|jdƒnd|rf|jdƒnd|rt|jƒnddœ}|j|ƒdS) Nzsnippets/authconfig-krb.confz krb5.confr_Z krb5kdcdnsr`Úkrb5kdcÚkrb5adminserver)Úrealmzkdc-srvz realm-srvZkdcZadminserverZdomain)rCr+r6rr,rJÚlowerrI)rr9r\rdÚkeysrrrrIãs zConfiguration.Kerberos.write)rrr rrBrHrIr]rr)rXrr^Òsr^cs$eZdZ‡fdd„Zdd„Z‡ZS)zConfiguration.Networkcsttj|ƒj|ƒdS)N)rVr>ÚNetworkr)rr?)rXrrr÷szConfiguration.Network.__init__cCs<|jdƒ}ttjdƒƒ}|dkr$dS|jd|ƒ|jƒdS)NÚ nisdomainr3Z NISDOMAIN)rJrr+r,r[rI)rrhr\rrrrIús zConfiguration.Network.write)rrr rrIr]rr)rXrrgösrgcs4eZdZ‡fdd„Zdd„Zdd„Zdd„Z‡ZS) zConfiguration.SSSDcsttj|ƒj|dddS)NÚsssd)rA)rVr>ÚSSSDr)rr?)rXrrrszConfiguration.SSSD.__init__cCs0|jdƒr|jdƒrdS|jdƒp.|jdƒS)NÚldapri)rKrM)rrrrrBszConfiguration.SSSD.isEnabledcCs|jtjdƒƒdS)Nz sssd.conf)rTr+r,)rrrrrHszConfiguration.SSSD.cleanupcCs¬|jdƒsdStjdƒ}t|tjdƒƒ}|jdƒr6dnd}|jdƒ|jdƒ|jdƒ||jdƒ|jd ƒ|jd ƒ|jdƒ|jdƒ|jd ƒdœ }|j|ƒtj tjdƒdddS)Nrkzsnippets/authconfig-sssd.confz sssd.confZ rfc2307bisrYrZZldaptlsÚkrb5rbrcr_Z cachecredsÚ smartcard) zldap-urizldap-basednzldap-tlszldap-schemarlzkdc-urizkpasswd-urirdzcache-credsz cert-authi€)Úmode) rMr+r6rr,rJrLrIr8Úchmod)rr9r\ZschemarfrrrrIs" zConfiguration.SSSD.write)rrr rrBrHrIr]rr)rXrrjsrjcs,eZdZ‡fdd„Zdd„Zdd„Z‡ZS)zConfiguration.Winbindcsttj|ƒj|dddS)NÚwinbind)rA)rVr>ÚWinbindr)rr?)rXrrr.szConfiguration.Winbind.__init__cCs0|jdƒr|jdƒrdS|jdƒp.|jdƒS)NrpÚwinbindauth)rKrM)rrrrrB1szConfiguration.Winbind.isEnabledcCsÂ|jdƒsdS|jjdƒjddƒ}|d}d}t|ƒdkrF|dd}ddd|d d g}|jdƒrr|j|jdƒƒttjdƒ||d }y|j ƒWn*t k r¼ttdƒtjdƒƒYnXdS)NZwinbindjoinú%r*rÚ rz-Uz"%s"z--client-softwarerpZsmbworkgroupz cmd-realm)rz)%s was not found. Please, install realmd.) rKr?rJÚsplitÚlenÚappendrr+r,rrRr r)rZcredsÚuserZpasswordr r%rrrrI7s$ zConfiguration.Winbind.write)rrr rrBrIr]rr)rXrrq-srqcs$eZdZ‡fdd„Zdd„Z‡ZS)zConfiguration.PWQualitycsttj|ƒj|ƒdS)N)rVr>Ú PWQualityr)rr?)rXrrrSsz Configuration.PWQuality.__init__c CsÊttjdƒƒ}d}|jdƒ|jdƒ|jdƒ|jdƒ|jddd d d|jddd d d|jd dd d d|jddd d ddœ}x@|jƒD]4\}}|dk r‚t|dt|ƒƒ|j||ƒd }q‚W|rÆ|j ƒdS)Nzpwquality.confFZ passminlenZpassminclassZ passmaxrepeatZpassmaxclassrepeatZreqlowerr*rT)rNZrequpperZreqdigitZreqother)ZminlenZminclassZ maxrepeatZmaxclassrepeatZlcreditZucreditZdcreditZocreditú=éÿÿÿÿr{r{r{) rr+r,rJrPÚitemsrÚstrr[rI)rr\Z value_setZpwoptsÚoptrOrrrrIVs"zConfiguration.PWQuality.write)rrr rrIr]rr)rXrryRsrycs,eZdZ‡fdd„Zdd„Zdd„Z‡ZS)zConfiguration.MakeHomedircsttj|ƒj|dddS)NZoddjobd)rA)rVr>ÚMakeHomedirr)rr?)rXrrrpsz"Configuration.MakeHomedir.__init__cCs|jdƒsdS|jdƒS)NÚ mkhomedir)rKrM)rrrrrBss z#Configuration.MakeHomedir.isEnabledcCsdS)Nr)rrFrrrrGysz(Configuration.MakeHomedir.disableService)rrr rrBrGr]rr)rXrrosrcs<eZdZ‡fdd„Zdd„Zdd„Zdd„Zd d „Z‡ZS)zConfiguration.NIScs*ttj|ƒj|ƒtdƒ|_tdƒ|_dS)NÚrpcbindÚypbind)rVr>ÚNISrr!rr‚)rr?)rXrrrs zConfiguration.NIS.__init__cCs|jdƒsdS|jdƒS)NÚnis)rKrM)rrrrrB„s zConfiguration.NIS.isEnabledcCsˆ|jdƒsdS|jdƒ}|s6ttjdƒ|gƒ}|jƒttjdƒdddgƒ}|jƒ|jjƒ|jjƒ|s„|jj dd|jj ƒdS) Nrhzcmd-domainnamez cmd-setseboolz-PÚallow_ypbindÚ1F)r1) rKrJrr+r,rrr)r‚r.)rrDZnisdomr%rrrrEŠs zConfiguration.NIS.enableServicecCsl|sttjdƒdgƒ}|jƒttjdƒdddgƒ}|jƒ|jjƒ|jjƒ|sh|jjƒ|jjƒdS)Nzcmd-domainnamez(none)z cmd-setseboolz-Pr…Ú0)rr+r,rrr-r‚r0)rrFr%rrrrGŸs z Configuration.NIS.disableServicec CsÞ|jdƒsdSd|jdƒ}g}|jdƒr\|jdƒjdƒ}|dd…}|d|dd7}n|d 7}x|D]}|d |d7}qjWtjdƒ}|jdƒrºtd |ƒt|ƒtd|ƒdSt|dƒ}|j|ƒWdQRXdS)Nrhzdomain Z nisserverú,r*z server rrtz broadcast z ypserver zyp.confz test-callz+========== BEGIN Content of [%s] ==========z,========== END Content of [%s] ========== Úw) rKrJrur+r,rMrÚopenrI)rÚoutputZadditional_serversZserversZserverrSÚfrrrrI¯s& zConfiguration.NIS.write) rrr rrBrErGrIr]rr)rXrrƒ~s rƒN) rrr ÚobjectrUrWr^rgrjrqryrrƒrrrrr>}sE$)%r>c@sLeZdZdd„Zdd„Zdd„Zdd„Zd d „Zdd„Zd d„Z dd„Z dS)Ú AuthCompatcCsBttjdƒƒ|_tƒ|_|jjƒ|jj|jƒ|jj|jƒdS)Nr2) rr+r,Ú sysconfigrr?ÚparseZapplysysconfigZupdatesysconfig)rrrrrÌs zAuthCompat.__init__cCspttdƒƒttdƒƒttdƒƒttdƒƒ|jjƒ}|rdttdƒƒx|D]}td|ƒqPWtdƒdS)Nz&Running authconfig compatibility tool.z¬The purpose of this tool is to enable authentication against chosen services with authselect and minimum configuration. It does not provide all capabilities of authconfig. zLIMPORTANT: authconfig is replaced by authselect, please update your scripts.zHSee man authselect-migration(7) to help you with migration to authselectzDWarning: These options are not supported anymore and have no effect:z --%sra)rrr?ZgetSetButUnsupported)rr?r"rrrÚprintWarningÔs zAuthCompat.printWarningcCs(x"tjD]}td|j|jfƒqWdS)Nz%s=%s)rZListrr"rO)rÚoptionrrrÚprintOptionsæszAuthCompat.printOptionscCs,x&|jjƒD]}td|j|jfƒqWdS)Nz%s=%s)rZgetallrr"rO)rÚlinerrrÚprintSysconfigêszAuthCompat.printSysconfigcCsÄddddg}dddg}|jjdƒr@tjƒdkr@ttd ƒƒd Sx,|D]$}|jj|ƒrFttd|ƒƒd SqFW|jjdƒ|jjd ƒkr–ttdƒƒd Sx|D]}|jj|ƒrœdSqœWttdƒƒd S)NZtestZprobeZ restorebackupZrestorelastbackupÚupdateZ updateallZ kickstartrz"authconfig can only be run as rootFzNError: option --%s is no longer supported and we cannot continue if it is set.rprrz@Error: Both --enablewinbind and --enablewinbindauth must be set.Tz*Error: Please, provide --updateall option.)r?rMr8Úgetuidrr)rZ disallowedr'r’rrrÚcanContinueîs$ zAuthCompat.canContinuec CsZddddddddœ}|jƒ\}}|jjd ƒsP|jjd ƒsP|jjdƒsP|jjdƒrVd}n"|jjd ƒrhd }n|jjdƒrxd}|dkr„d}xV|jƒD]J\}}|jj|ƒs¤qŽ|jj|ƒ}|rÀ|j|ƒqŽx||krÖ|j|ƒqÂWqŽW|jjdƒrt|jjdƒƒdkr|jdƒn |jdƒt t |ƒƒ}d|g}|j|ƒ|jdƒtt jdƒ|ƒ}|jƒdS)Nzwith-smartcardzwith-smartcard-requiredzwith-fingerprintzwith-mkhomedirz with-faillockzwith-pamaccessz with-krb5)rmZrequiresmartcardZfingerprintr€ZfaillockZ pamaccessZwinbindkrb5rkZldapauthriZsssdauthr„rpZsmartcardactionrzwith-smartcard-lock-on-removalZselectz--forcezcmd-authselect)ÚgetCurrentAuthselectConfigr?rMr|rKrwrQÚintrJÚlistr[Úextendrr+r,r) rÚmapZprofileZfeaturesr’ZfeatureÚenabledr r%rrrÚ runAuthselect sJ zAuthCompat.runAuthselectcCs~ttjdƒdgdd}|jƒ|jdks4|jjdkrrWr?rgr^rjrqryrrƒrIrMrBrErGrHrr#r rrr%r$rr&)rZconfigsr\rDržrrrrÚwriteConfigurationUs. zAuthCompat.writeConfigurationN)rrr rr‘r“r•r˜rŸr™r¡rrrrrŽËs> rŽcCsþytjtjdƒWn"tjk r4tjjdƒYnXtƒ}|jƒ|j j dƒt_|j j dƒt _|j j dƒt_|jƒs€tjdƒy|jƒ|jƒ|jjƒWnPtjk rî}z2ttdƒdj|jƒ|jfƒt|jjƒƒWYdd}~XnXtjdƒdS)Nraz%Warning: Unsupported locale setting. z test-callr*z$Command [%s] failed with %d, stderr:rr)ÚlocaleÚ setlocaleÚLC_ALLÚErrorrrrIrŽr‘r?rMrrrrr˜ÚexitrŸr¡rrr#r rrr%r$r&)Z authcompatrrrrÚmainzs( r§Ú__main__)r8rr¢ÚgettextrZauthcompat_OptionsrZauthcompat_EnvironmentFilerZauthcompat_ConfigSnippetrrr rr!r+r>rŽr§rrrrrÚs(#P0PKEhe[‚¦àÚ'Ú'3__pycache__/authcompat_Options.cpython-36.opt-1.pycnu„[µü¤3 [Ø*e¬6ã@s6ddlZddlZejZGdd„dƒZGdd„dƒZdS)éNc@steZdZdd„Zdd„Zdd„Zdd„Zed d „ƒZedd„ƒZ ed d„ƒZ edd„ƒZedd„ƒZedd„ƒZ dS)ÚOptioncCs.||_||_||_||_||_d|_d|_dS)NF)ÚnameÚmetavarÚhelpÚfeatureÚ supportedÚvalueÚfrom_sysconfig)Úselfrrrrr©rú(/usr/lib/python3.6/authcompat_Options.pyÚ__init__szOption.__init__cCs ||_dS)N)r)r Ú new_valuerrrÚset&sz Option.setcCs|j|ƒd|_dS)NT)rr )r rrrrÚset_from_sysconfig)s zOption.set_from_sysconfigcCs |jdk S)N)r)r rrrÚisset-szOption.issetcCst|||dddS)NFT)rr)r)rrrrrrÚValued0sz Option.ValuedcCst|d|dddS)NFT)rr)r)rrrrrÚSwitch4sz Option.SwitchcCst|d|dddS)NT)rr)r)rrrrrÚFeature8szOption.FeaturecCst||ddddS)NF)rr)r)rrrrrÚUnsupportedValued<szOption.UnsupportedValuedcCst|dddddS)NTF)rr)r)rrrrÚUnsupportedFeature@szOption.UnsupportedFeaturecCst|dddddS)NF)rr)r)rrrrÚUnsupportedSwitchDszOption.UnsupportedSwitchN)Ú__name__Ú __module__Ú__qualname__r rrrÚstaticmethodrrrrrrrrrrrs rcM@sºeZdZejdedƒƒejdedƒedƒƒejdedƒedƒƒejd ed ƒƒejdedƒƒejd edƒedƒƒejdedƒedƒƒejdedƒƒejdedƒƒejdedƒƒejdedƒƒejdedƒedƒƒejdedƒƒejded ƒƒejd!ed"ƒƒejd#edƒed$ƒƒejd%edƒed&ƒƒejd'ed(ƒed)ƒƒejd*ed+ƒƒejd,ed-ƒƒejd.ed/ƒƒejd0ed1ƒƒejd2ed3ƒed4ƒƒejd5ed6ƒƒejd7ed8ƒed9ƒƒejd:ed;ƒƒejded?ƒƒejd@edAƒƒejdBedCƒƒejdDedEƒƒejdFedGƒedHƒƒejdIedGƒedJƒƒejdKedGƒedLƒƒejdMedGƒedNƒƒejdOedPƒƒejdQedRƒƒejdSedTƒƒejdUedVƒƒejdWedXƒƒejdYedZƒƒejd[ed\ƒƒejd]ed\ƒƒejd^ej ƒej d_ƒej d`ƒejdaedbƒƒejdcedbƒƒej ddƒejdeƒejdfƒejdgƒej dhƒejdiƒej djƒejdkedlƒƒejdmednƒƒejdoedpƒƒejdqedrƒƒejdsed(ƒƒejdteduƒƒejdvedwƒƒejdxedwƒƒejdyedwƒƒejdzed{ƒƒejd|ed}ƒƒejd~edƒƒejd€ƒejdƒejd‚ƒejdƒƒejd„ƒejd…ƒejd†ed‡ƒƒgJZ dDd†d ddfd.d5d:d!dddddkdidgd0ddˆœZd‰dŠ„Zd‹dŒ„ZddŽ„Zdd„Zd‘d’„Zd“d”„Zd•d–„Zd—d˜„Zd™dš„Zd›dœ„Zddž„ZdŸd „Zd¡d¢„Zd£d¤„Zd¥S)¦ÚOptionsZnisz#NIS for user information by defaultZ nisdomainzzdefault NIS domainZ nisserverzzdefault NIS serverZldapz$LDAP for user information by defaultZldapauthz"LDAP for authentication by defaultZ ldapserverz#default LDAP server hostname or URIZ ldapbasednzzdefault LDAP base DNÚldaptlszuse of TLS with LDAP (RFC-2830)Úldapstarttlsz4use of TLS for identity lookups with LDAP (RFC-2830)Z rfc2307bisz;use of RFC-2307bis schema for LDAP user information lookupsZ smartcardz)authentication with smart card by defaultZsmartcardactionz<0=Lock|1=Ignore>z(action to be taken on smart card removalZrequiresmartcardz0require smart card for authentication by defaultZfingerprintz2authentication with fingerprint readers by defaultZkrb5z"Kerberos authentication by defaultZkrb5kdczdefault Kerberos KDCZkrb5adminserverzdefault Kerberos admin serverZ krb5realmzzdefault Kerberos realmZ krb5kdcdnsz use of DNS to find Kerberos KDCsZkrb5realmdnsz"use of DNS to find Kerberos realmsZwinbindz'winbind for user information by defaultZwinbindauthz%winbind for authentication by defaultZwinbindjoinzz>join the winbind domain or ads realm now as this administratorZwinbindkrb5z(Kerberos 5 for authenticate with winbindZsmbworkgroupzz'workgroup authentication servers are inZsssdzHSSSD for user information by default with manually managed configurationZsssdauthzFSSSD for authentication by default with manually managed configurationZ cachecredsz.caching of user credentials in SSSD by defaultZ pamaccessz1check of access.conf during account authorizationZ mkhomedirz;creation of home directories for users on their first loginZfaillockzGaccount locking in case of too many consecutive authentication failuresZ passminlenzzminimum length of a passwordZpassminclassz1minimum number of character classes in a passwordZ passmaxrepeatz;maximum number of same consecutive characters in a passwordZpassmaxclassrepeatzDmaximum number of consecutive characters of same class in a passwordZreqlowerz6require at least one lowercase character in a passwordZrequpperz6require at least one uppercase character in a passwordZreqdigitz(require at least one digit in a passwordZreqotherz2require at least one other character in a passwordZnostartzdo not start/stop servicesZ updateallzupdate all configuration filesÚupdatezthe same as --updateallZ kickstartz test-callZtestZprobeZ savebackupzZ restorebackupZrestorelastbackupÚcacheZecryptfsÚshadowÚ useshadowÚmd5Úusemd5Zpassalgoz%ZldaploadcacertzZsmartcardmodulezZsmbsecurityzZsmbrealmZ smbserversz Z smbidmaprangezZsmbidmapuidZsmbidmapgidZwinbindseparatorz<\>Zwinbindtemplatehomedirz ZwinbindtemplateshellzZwinbindusedefaultdomainZwinbindofflineZ preferdnsZforcelegacyZlocauthorizeZ sysnetauthZfaillockargsz )ZUSEFAILLOCKZFAILLOCKARGSZUSELDAPZUSENISZUSEECRYPTFSZ USEWINBINDZWINBINDKRB5ZUSESSSDZUSEKERBEROSZUSELDAPAUTHZUSESMARTCARDZFORCESMARTCARDZ USEFPRINTDZPASSWDALGORITHMZUSEMD5Z USESHADOWZUSEWINBINDAUTHZUSESSSDAUTHZUSELOCAUTHORIZEZUSEPAMACCESSZUSEMKHOMEDIRZ USESYSNETAUTHZFORCELEGACYZCACHECREDENTIALScCs&i|_x|jD]}||j|j<qWdS)N)ÚoptionsÚListr)r Úoptionrrrr ÈszOptions.__init__cCs tjdd}|jtdƒƒ|jtdƒƒdœ}x,|jD]"}|jr@dnd}|j|||ƒq2W|jƒ}x*|jj ƒD]\}}t ||ƒ}|j|ƒqlW|jdƒr´|jd ƒr´|jd|j d ƒƒ|jd ƒrÜ|jdƒrÜ|jd |j dƒƒ|jdƒoð|jd ƒr|jd |j dƒƒdS)NzAuthconfig Compatibility Tool.)Údescriptionz(These options have a compatibility layerz8These options are no longer supported and have no effect)rÚunsupportedrr)r#r$r!r"rr)ÚargparseÚArgumentParserZadd_argument_groupÚ_r&rÚ add_optionÚ parse_argsr%ÚitemsÚgetattrrrÚget)r ÚparserZparsersr'ÚgroupZcmdlinerrrrrÚparseÎs z Options.parsecCs<x6|jjƒD](\}}|j|ƒs|j|j|j|ƒƒqWdS)N)ÚMapr/rr%rr1)r Ú sysconfigrr'rrrÚapplysysconfigës zOptions.applysysconfigcCs8x2|jjƒD]$\}}|j|ƒr|j||j|ƒƒqWdS)N)r5r/rrr1)r r6rr'rrrÚupdatesysconfigðs zOptions.updatesysconfigcCs|j|jS)N)r%r)r rrrrr1õszOptions.getcCs|j|j|ƒdS)N)r%r)r rrrrrrøszOptions.setcCs|j|jƒS)N)r%r)r rrrrrûsz Options.issetcCs |j|ƒ}|dks|rdSdS)NFT)r1)r rrrrrÚgetBoolþs zOptions.getBoolcCs |j|ƒ}|dks|rdSdS)NT)r1)r rrrrrÚ getTrueOrNones zOptions.getTrueOrNonecCs^g}xTtjD]J}|jrq|jƒs"q|jr*q|j}|jrL|jrDd|nd|}|j|ƒqW|S)NÚenableÚdisable) rr&rrr rrrÚappend)r r%r'rrrrÚgetSetButUnsupported szOptions.getSetButUnsupportedcCs<|jdk r|j||ƒn |jr,|j||ƒn|j||ƒdS)N)rÚ add_valuedrÚadd_featureÚ add_switch)r r2r'rrrr-s zOptions.add_optioncCs$|jd|jd|j|j|jddS)Nz--Zstore)ÚactionrÚdestr)Úadd_argumentrrr)r r2r'rrrr?&s zOptions.add_valuedcCs"|jd|jdd|j|jddS)Nz--Ústore_constT)rBÚconstrrC)rDrr)r r2r'rrrrA-s zOptions.add_switchcCsrd}d}|jdk r6tdƒd|j}tdƒd|j}|jd|jdd||jd|jd|jdd ||jddS) Nr;ú r<z--enablerET)rBrFrrCz --disableF)rr,rDr)r r2r'Zhelp_enableZhelp_disablerrrr@4s zOptions.add_featureN)rrrrrr,rrr*ZSUPPRESSrrrr&r5r r4r7r8r1rrr9r:r>r-r?rAr@rrrrrIsà r)r*Úgettextr,rrrrrrÚs-PKEhe[ü¿À¬´M´M%__pycache__/authcompat.cpython-36.pycnu„[µü¤3 ŸØ*e)Vã@sºddlZddlZddlZddlZddlZddlmZddlmZddl m Z ejZdd„ZGdd„dƒZ Gd d „d ƒZGdd„dƒZGd d„dƒZGdd„dƒZdd„Zedkr¶eƒdS)éN)ÚOptions)ÚEnvironmentFile)Ú ConfigSnippetcOst|dtji|—ŽdS)NÚfile)ÚprintÚsysÚstderr)ÚargsÚkwargs©rú /usr/lib/python3.6/authcompat.pyÚeprint%sr c@s"eZdZdZddd„Zdd„ZdS) ÚCommandFNTcCs2|g||_|dk r|jƒnd|_||_d|_dS)N)r ÚencodeÚinputÚcheckÚresult)ÚselfÚcommandr rrrrrÚ__init__,szCommand.__init__cCsFttdƒdj|jƒƒ|jr"dStj|j|j|jtj tj d|_ dS)Nz Executing: %sú )rrÚstdoutr)rÚ_Újoinr ÚTESTÚ subprocessÚrunrrÚPIPEr)rrrrr2szCommand.run)NT)Ú__name__Ú __module__Ú__qualname__rrrrrrrr)s rc@s>eZdZdd„Zdd„Zdd„Zdd„Zdd d„Zdd „ZdS)ÚServicecCs|d|_dS)Nz.service)Úname)rr"rrrr?szService.__init__cCsŽy|jƒWn|tjk rˆ}z^|rB|j|krBttdƒ|jƒn6|j|krxttdƒdj|jƒ|jfƒt|j j ƒƒWYdd}~XnXdS)Nz5Service %s was not found. Please install the service.z$Command [%s] failed with %d, stderr:r)rrÚCalledProcessErrorÚ returncoder rr"rÚcmdrÚdecode)rrÚrequiredZenoent_coderrrrÚ runsystemdBs zService.runsystemdcCs(ttjdƒd|jgƒ}|j|ddƒdS)Nz cmd-systemctlÚenableTé)rÚPathÚSystemr"r()rr%rrrr)NszService.enablecCs(ttjdƒd|jgƒ}|j|ddƒdS)Nz cmd-systemctlÚdisableFr*)rr+r,r"r()rr%rrrr-RszService.disableTcCs4|r|jƒttjdƒd|jgƒ}|j|ddƒdS)Nz cmd-systemctlÚstartTé)Ústoprr+r,r"r()rÚRestartr%rrrr.Vsz Service.startcCs(ttjdƒd|jgƒ}|j|ddƒdS)Nz cmd-systemctlr0Fr/)rr+r,r"r()rr%rrrr0\szService.stopN)T) rrr rr(r)r-r.r0rrrrr!>s r!c @sbeZdZejjejjeƒƒZe edƒZ dddddddd d ddd dœZedd„ƒZ edd„ƒZdS)r+z/authcompat_pathsz/etc/openldap/ldap.confz$/etc/krb5.conf.d/authconfig-krb.confz%/etc/sssd/conf.d/authconfig-sssd.confz/etc/sysconfig/authconfigz/etc/sysconfig/networkz;/etc/security/pwquality.conf.d/10-authconfig-pwquality.confz/etc/yp.confz/usr/bin/systemctlz/usr/bin/authselectz/usr/sbin/realmz/usr/bin/domainnamez/usr/sbin/setsebool)z ldap.confz krb5.confz sssd.confÚ authconfigÚnetworkzpwquality.confzyp.confz cmd-systemctlzcmd-authselectz cmd-realmzcmd-domainnamez cmd-setseboolcCsdtj|fS)Nz%s/%s)r+ÚLocalDir)ÚrelpathrrrÚLocaltsz Path.LocalcCs tj|S)N)r+ÚFiles)r"rrrr,xszPath.SystemN)rrr ÚosÚpathÚdirnameÚrealpathÚ__file__r4rZConfigr7Ústaticmethodr6r,rrrrr+as r+c@sœeZdZGdd„deƒZGdd„deƒZGdd„deƒZGdd„deƒZGd d „d eƒZGdd„deƒZ Gd d„deƒZ Gdd„deƒZGdd„deƒZdS)Ú Configurationc@sxeZdZddd„Zdd„Zdd„Zdd „Zd d„Zdd „Zdd„Z dd„Z dd„Zdd„Zdd„Z ddd„Zdd„ZdS)zConfiguration.BaseNcCs"||_d|_|dk rt|ƒ|_dS)N)ÚoptionsÚservicer!)rr?ÚServiceNamerrrrszConfiguration.Base.__init__cCsdS)NTr)rrrrÚ isEnabled…szConfiguration.Base.isEnabledcCs |jƒS)N)rB)rrrrÚ isDisabledˆszConfiguration.Base.isDisabledcCs*|jdkrdS|jjƒ|s&|jjƒdS)N)r@r)r.)rÚnostartrrrÚ enableService‹s z Configuration.Base.enableServicecCs*|jdkrdS|jjƒ|s&|jjƒdS)N)r@r-r0)rÚnostoprrrÚdisableService”s z!Configuration.Base.disableServicecCsdS)Nr)rrrrÚcleanupszConfiguration.Base.cleanupcCsdS)Nr)rrrrÚwrite szConfiguration.Base.writecCs|jj|ƒS)N)r?Úget)rr"rrrrJ£szConfiguration.Base.getcCs|jj|ƒS)N)r?Úisset)rr"rrrrK¦szConfiguration.Base.issetcCs|jj|ƒS)N)r?Ú getTrueOrNone)rr"rrrrL©sz Configuration.Base.getTrueOrNonecCs|jj|ƒS)N)r?ÚgetBool)rr"rrrrM¬szConfiguration.Base.getBoolFcCs*|r|j|ƒrdS|j|ƒ}|r&|S|S)N)rKrM)rr"Zif_trueZif_falseÚ AllowNoneÚvaluerrrÚgetBoolAsValue¯s z!Configuration.Base.getBoolAsValuecCsHttdƒ|ƒ|jjdƒr dSytj|ƒWntk rBdSXdS)NzRemoving file: %sz test-call)rrr?rMr8ÚremoveÚFileNotFoundError)rÚfilenamerrrÚ removeFile¹szConfiguration.Base.removeFile)N)F)rrr rrBrCrErGrHrIrJrKrLrMrPrTrrrrÚBase~s rUcs$eZdZ‡fdd„Zdd„Z‡ZS)zConfiguration.LDAPcsttj|ƒj|ƒdS)N)Úsuperr>ÚLDAPr)rr?)Ú __class__rrrÄszConfiguration.LDAP.__init__cCsZttjdƒdddd}|jdƒr2|jd|jdƒƒ|jdƒrN|jd |jdƒƒ|jƒdS) Nz ldap.confrz\s\tF)Zdelimiter_reZquotesÚ ldapserverZURIÚ ldapbasednZBASE)rr+r,rKÚsetrJrI)rÚconfigrrrrIÇs zConfiguration.LDAP.write)rrr rrIÚ __classcell__rr)rXrrWÃsrWcs4eZdZ‡fdd„Zdd„Zdd„Zdd„Z‡ZS) zConfiguration.Kerberoscsttj|ƒj|ƒdS)N)rVr>ÚKerberosr)rr?)rXrrrÓszConfiguration.Kerberos.__init__cCs4|jdƒr|jdƒrdS|jdƒdkp2|jdƒS)NÚ krb5realmÚkrb5realmdnsÚ)rKrJrM)rrrrrBÖsz Configuration.Kerberos.isEnabledcCs0|jdƒr|jdƒrdS|jtjdƒƒdS)Nr_r`z krb5.conf)rKrTr+r,)rrrrrHÜszConfiguration.Kerberos.cleanupcCsŠ|jƒrdStjdƒ}t|tjdƒƒ}|jdƒ}|jdƒ|jdƒ|jdƒ|rV|jdƒnd|rf|jdƒnd|rt|jƒnddœ}|j|ƒdS) Nzsnippets/authconfig-krb.confz krb5.confr_Z krb5kdcdnsr`Úkrb5kdcÚkrb5adminserver)Úrealmzkdc-srvz realm-srvZkdcZadminserverZdomain)rCr+r6rr,rJÚlowerrI)rr9r\rdÚkeysrrrrIãs zConfiguration.Kerberos.write)rrr rrBrHrIr]rr)rXrr^Òsr^cs$eZdZ‡fdd„Zdd„Z‡ZS)zConfiguration.Networkcsttj|ƒj|ƒdS)N)rVr>ÚNetworkr)rr?)rXrrr÷szConfiguration.Network.__init__cCs<|jdƒ}ttjdƒƒ}|dkr$dS|jd|ƒ|jƒdS)NÚ nisdomainr3Z NISDOMAIN)rJrr+r,r[rI)rrhr\rrrrIús zConfiguration.Network.write)rrr rrIr]rr)rXrrgösrgcs4eZdZ‡fdd„Zdd„Zdd„Zdd„Z‡ZS) zConfiguration.SSSDcsttj|ƒj|dddS)NÚsssd)rA)rVr>ÚSSSDr)rr?)rXrrrszConfiguration.SSSD.__init__cCs0|jdƒr|jdƒrdS|jdƒp.|jdƒS)NÚldapri)rKrM)rrrrrBszConfiguration.SSSD.isEnabledcCs|jtjdƒƒdS)Nz sssd.conf)rTr+r,)rrrrrHszConfiguration.SSSD.cleanupcCs¬|jdƒsdStjdƒ}t|tjdƒƒ}|jdƒr6dnd}|jdƒ|jdƒ|jdƒ||jdƒ|jd ƒ|jd ƒ|jdƒ|jdƒ|jd ƒdœ }|j|ƒtj tjdƒdddS)Nrkzsnippets/authconfig-sssd.confz sssd.confZ rfc2307bisrYrZZldaptlsÚkrb5rbrcr_Z cachecredsÚ smartcard) zldap-urizldap-basednzldap-tlszldap-schemarlzkdc-urizkpasswd-urirdzcache-credsz cert-authi€)Úmode) rMr+r6rr,rJrLrIr8Úchmod)rr9r\ZschemarfrrrrIs" zConfiguration.SSSD.write)rrr rrBrHrIr]rr)rXrrjsrjcs,eZdZ‡fdd„Zdd„Zdd„Z‡ZS)zConfiguration.Winbindcsttj|ƒj|dddS)NÚwinbind)rA)rVr>ÚWinbindr)rr?)rXrrr.szConfiguration.Winbind.__init__cCs0|jdƒr|jdƒrdS|jdƒp.|jdƒS)NrpÚwinbindauth)rKrM)rrrrrB1szConfiguration.Winbind.isEnabledcCsÂ|jdƒsdS|jjdƒjddƒ}|d}d}t|ƒdkrF|dd}ddd|d d g}|jdƒrr|j|jdƒƒttjdƒ||d }y|j ƒWn*t k r¼ttdƒtjdƒƒYnXdS)NZwinbindjoinú%r*rÚ rz-Uz"%s"z--client-softwarerpZsmbworkgroupz cmd-realm)rz)%s was not found. Please, install realmd.) rKr?rJÚsplitÚlenÚappendrr+r,rrRr r)rZcredsÚuserZpasswordr r%rrrrI7s$ zConfiguration.Winbind.write)rrr rrBrIr]rr)rXrrq-srqcs$eZdZ‡fdd„Zdd„Z‡ZS)zConfiguration.PWQualitycsttj|ƒj|ƒdS)N)rVr>Ú PWQualityr)rr?)rXrrrSsz Configuration.PWQuality.__init__c CsÊttjdƒƒ}d}|jdƒ|jdƒ|jdƒ|jdƒ|jddd d d|jddd d d|jd dd d d|jddd d ddœ}x@|jƒD]4\}}|dk r‚t|dt|ƒƒ|j||ƒd }q‚W|rÆ|j ƒdS)Nzpwquality.confFZ passminlenZpassminclassZ passmaxrepeatZpassmaxclassrepeatZreqlowerr*rT)rNZrequpperZreqdigitZreqother)ZminlenZminclassZ maxrepeatZmaxclassrepeatZlcreditZucreditZdcreditZocreditú=éÿÿÿÿr{r{r{) rr+r,rJrPÚitemsrÚstrr[rI)rr\Z value_setZpwoptsÚoptrOrrrrIVs"zConfiguration.PWQuality.write)rrr rrIr]rr)rXrryRsrycs,eZdZ‡fdd„Zdd„Zdd„Z‡ZS)zConfiguration.MakeHomedircsttj|ƒj|dddS)NZoddjobd)rA)rVr>ÚMakeHomedirr)rr?)rXrrrpsz"Configuration.MakeHomedir.__init__cCs|jdƒsdS|jdƒS)NÚ mkhomedir)rKrM)rrrrrBss z#Configuration.MakeHomedir.isEnabledcCsdS)Nr)rrFrrrrGysz(Configuration.MakeHomedir.disableService)rrr rrBrGr]rr)rXrrosrcs<eZdZ‡fdd„Zdd„Zdd„Zdd„Zd d „Z‡ZS)zConfiguration.NIScs*ttj|ƒj|ƒtdƒ|_tdƒ|_dS)NÚrpcbindÚypbind)rVr>ÚNISrr!rr‚)rr?)rXrrrs zConfiguration.NIS.__init__cCs|jdƒsdS|jdƒS)NÚnis)rKrM)rrrrrB„s zConfiguration.NIS.isEnabledcCsˆ|jdƒsdS|jdƒ}|s6ttjdƒ|gƒ}|jƒttjdƒdddgƒ}|jƒ|jjƒ|jjƒ|s„|jj dd|jj ƒdS) Nrhzcmd-domainnamez cmd-setseboolz-PÚallow_ypbindÚ1F)r1) rKrJrr+r,rrr)r‚r.)rrDZnisdomr%rrrrEŠs zConfiguration.NIS.enableServicecCsl|sttjdƒdgƒ}|jƒttjdƒdddgƒ}|jƒ|jjƒ|jjƒ|sh|jjƒ|jjƒdS)Nzcmd-domainnamez(none)z cmd-setseboolz-Pr…Ú0)rr+r,rrr-r‚r0)rrFr%rrrrGŸs z Configuration.NIS.disableServicec CsÞ|jdƒsdSd|jdƒ}g}|jdƒr\|jdƒjdƒ}|dd…}|d|dd7}n|d 7}x|D]}|d |d7}qjWtjdƒ}|jdƒrºtd |ƒt|ƒtd|ƒdSt|dƒ}|j|ƒWdQRXdS)Nrhzdomain Z nisserverú,r*z server rrtz broadcast z ypserver zyp.confz test-callz+========== BEGIN Content of [%s] ==========z,========== END Content of [%s] ========== Úw) rKrJrur+r,rMrÚopenrI)rÚoutputZadditional_serversZserversZserverrSÚfrrrrI¯s& zConfiguration.NIS.write) rrr rrBrErGrIr]rr)rXrrƒ~s rƒN) rrr ÚobjectrUrWr^rgrjrqryrrƒrrrrr>}sE$)%r>c@sLeZdZdd„Zdd„Zdd„Zdd„Zd d „Zdd„Zd d„Z dd„Z dS)Ú AuthCompatcCsBttjdƒƒ|_tƒ|_|jjƒ|jj|jƒ|jj|jƒdS)Nr2) rr+r,Ú sysconfigrr?ÚparseZapplysysconfigZupdatesysconfig)rrrrrÌs zAuthCompat.__init__cCspttdƒƒttdƒƒttdƒƒttdƒƒ|jjƒ}|rdttdƒƒx|D]}td|ƒqPWtdƒdS)Nz&Running authconfig compatibility tool.z¬The purpose of this tool is to enable authentication against chosen services with authselect and minimum configuration. It does not provide all capabilities of authconfig. zLIMPORTANT: authconfig is replaced by authselect, please update your scripts.zHSee man authselect-migration(7) to help you with migration to authselectzDWarning: These options are not supported anymore and have no effect:z --%sra)rrr?ZgetSetButUnsupported)rr?r"rrrÚprintWarningÔs zAuthCompat.printWarningcCs(x"tjD]}td|j|jfƒqWdS)Nz%s=%s)rZListrr"rO)rÚoptionrrrÚprintOptionsæszAuthCompat.printOptionscCs,x&|jjƒD]}td|j|jfƒqWdS)Nz%s=%s)rZgetallrr"rO)rÚlinerrrÚprintSysconfigêszAuthCompat.printSysconfigcCsÄddddg}dddg}|jjdƒr@tjƒdkr@ttd ƒƒd Sx,|D]$}|jj|ƒrFttd|ƒƒd SqFW|jjdƒ|jjd ƒkr–ttdƒƒd Sx|D]}|jj|ƒrœdSqœWttdƒƒd S)NZtestZprobeZ restorebackupZrestorelastbackupÚupdateZ updateallZ kickstartrz"authconfig can only be run as rootFzNError: option --%s is no longer supported and we cannot continue if it is set.rprrz@Error: Both --enablewinbind and --enablewinbindauth must be set.Tz*Error: Please, provide --updateall option.)r?rMr8Úgetuidrr)rZ disallowedr'r’rrrÚcanContinueîs$ zAuthCompat.canContinuec CsZddddddddœ}|jƒ\}}|jjd ƒsP|jjd ƒsP|jjdƒsP|jjdƒrVd}n"|jjd ƒrhd }n|jjdƒrxd}|dkr„d}xV|jƒD]J\}}|jj|ƒs¤qŽ|jj|ƒ}|rÀ|j|ƒqŽx||krÖ|j|ƒqÂWqŽW|jjdƒrt|jjdƒƒdkr|jdƒn |jdƒt t |ƒƒ}d|g}|j|ƒ|jdƒtt jdƒ|ƒ}|jƒdS)Nzwith-smartcardzwith-smartcard-requiredzwith-fingerprintzwith-mkhomedirz with-faillockzwith-pamaccessz with-krb5)rmZrequiresmartcardZfingerprintr€ZfaillockZ pamaccessZwinbindkrb5rkZldapauthriZsssdauthr„rpZsmartcardactionrzwith-smartcard-lock-on-removalZselectz--forcezcmd-authselect)ÚgetCurrentAuthselectConfigr?rMr|rKrwrQÚintrJÚlistr[Úextendrr+r,r) rÚmapZprofileZfeaturesr’ZfeatureÚenabledr r%rrrÚ runAuthselect sJ zAuthCompat.runAuthselectcCs~ttjdƒdgdd}|jƒ|jdks4|jjdkrrWr?rgr^rjrqryrrƒrIrMrBrErGrHrr#r rrr%r$rr&)rZconfigsr\rDržrrrrÚwriteConfigurationUs. zAuthCompat.writeConfigurationN)rrr rr‘r“r•r˜rŸr™r¡rrrrrŽËs> rŽcCsþytjtjdƒWn"tjk r4tjjdƒYnXtƒ}|jƒ|j j dƒt_|j j dƒt _|j j dƒt_|jƒs€tjdƒy|jƒ|jƒ|jjƒWnPtjk rî}z2ttdƒdj|jƒ|jfƒt|jjƒƒWYdd}~XnXtjdƒdS)Nraz%Warning: Unsupported locale setting. z test-callr*z$Command [%s] failed with %d, stderr:rr)ÚlocaleÚ setlocaleÚLC_ALLÚErrorrrrIrŽr‘r?rMrrrrr˜ÚexitrŸr¡rrr#r rrr%r$r&)Z authcompatrrrrÚmainzs( r§Ú__main__)r8rr¢ÚgettextrZauthcompat_OptionsrZauthcompat_EnvironmentFilerZauthcompat_ConfigSnippetrrr rr!r+r>rŽr§rrrrrÚs(#P0PKEhe[˜Ès"3__pycache__/authcompat_ConfigSnippet.cpython-36.pycnu„[µü¤3 Ù¥ˆcã@s*ddlZddlZddlZGdd„dƒZdS)éNc@s>eZdZdZejdƒZejdƒZdd„Zdd„Z ddd „Z d S)Ú ConfigSnippetFz\${\??(?P[\w-]*)}z\${\?[\w-]*}c Cs*t|dƒ}|jƒ|_WdQRX||_dS)NÚr)ÚopenÚreadÚtemplateÚdestination)ÚselfrrÚf©r ú./usr/lib/python3.6/authcompat_ConfigSnippet.pyÚ__init__!szConfigSnippet.__init__c Csæ|jjdƒ}g}xTt|ƒD]H\}}x>|jj|ƒD].}|jdƒ}||ksR||dkr0|j|ƒPq0WqWxt|ddD] }||=qtWdj|ƒ}|j j d|ƒ}xF|jƒD]:\}} | dkr¶q¤t| ƒt krÎ| rÊdnd} |jd|| ƒ}q¤W|S) NÚ ÚkeyT)ÚreverseÚÚtrueZfalsez${%s})rÚsplitÚ enumerateÚ AllKeysREÚfinditerÚgroupÚappendÚsortedÚjoinÚDummyKeysREÚsubÚitemsÚtypeÚboolÚreplace) rÚvaluesÚlinesÚremoveÚidxÚlineÚmatchrÚoutputÚvaluer r rÚgenerate's& zConfigSnippet.generatecCsÆ|j|ƒ}|jr8td|jƒt|ƒtd|jƒdStjj|jƒ}tjj|ƒs ytj|ƒWn>t k rž}z"|j t jkrŒtjj|ƒrŒn‚WYdd}~XnXt |jdƒ}|j|ƒWdQRXdS)Nz+========== BEGIN Content of [%s] ==========z,========== END Content of [%s] ========== Úw)r(ÚTESTÚprintrÚosÚpathÚdirnameÚexistsÚmakedirsÚOSErrorÚerrnoZEEXISTÚisdirrÚwrite)rr Z to_stdoutr&r.Z exceptionr r r rr4Hs zConfigSnippet.writeN)F)Ú__name__Ú __module__Ú__qualname__r*ÚreÚcompilerrrr(r4r r r rrs !r)r2r,r8rr r r rÚsPKEhe[êâðÐcc;__pycache__/authcompat_EnvironmentFile.cpython-36.opt-1.pycnu„[µü¤3 Ù¥ˆcLã@s*ddlZddlZddlZGdd„dƒZdS)éNc@sReZdZdZddd„Zdd„Zd d „Zddd„Zd d„Zdd„Z Gdd„dƒZ dS)ÚEnvironmentFileFú=NTcCsL||_||_||_g|_|dk r$|n|}tjd|dtjƒ|_|jƒdS)Nz^(\s*)(\S*)([^\n\S]*)(z)([^\n\S]*)(.*)$) ÚfilenameÚ delimiterÚquotesÚenvironmentÚreÚcompileÚ MULTILINEÚpatternÚread)ÚselfrrZdelimiter_rer©rú0/usr/lib/python3.6/authcompat_EnvironmentFile.pyÚ__init__s zEnvironmentFile.__init__cCspy$t|jdƒ}|jƒ}WdQRXWntk r8dSXx0|D](}|jj||j|j|jƒ}|j j |ƒq@WdS)NÚr)ÚopenrÚ readlinesÚFileNotFoundErrorÚLineÚParserrrrÚappend)r ÚfÚlinesÚlineZparsedrrrr.s zEnvironmentFile.readcCsÜd}x|jD]}||jƒ}qW|jrNtd|jƒt|ƒtd|jƒdStjj|jƒ}tjj|ƒs¶ytj |ƒWn>t k r´}z"|jtjkr¢tjj |ƒr¢n‚WYdd}~XnXt|jdƒ}|j|ƒWdQRXdS)NÚz+========== BEGIN Content of [%s] ==========z,========== END Content of [%s] ========== Úw)rÚgetLineÚTESTÚprintrÚosÚpathÚdirnameÚexistsÚmakedirsÚOSErrorÚerrnoZEEXISTÚisdirrÚwrite)r Úoutputrr"Z exceptionrrrrr(:s$zEnvironmentFile.writecCs\d}x&|jD]}|jƒr|j|kr|j}qW|dkr8|S|jƒdkrHdS|jƒdkrXd S|S) NÚnoÚfalserÚnFÚyesÚtrueÚtÚyT)Nr*r+rr,)r-r.r/r0)rÚ isVariableÚnameÚvalueÚlower)r r2Údefaultr3rrrrÚgetRs zEnvironmentFile.getcCs*g}x |jD]}|jƒr|j|ƒqW|S)N)rr1r)r rrrrrÚgetallbs zEnvironmentFile.getallcCsvt|ƒtkr|rdnd}x0|jD]&}|jƒr |j|kr |j||ƒdSq W|j|j|jƒ}|j||ƒ|jj |ƒdS)Nr-r*) ÚtypeÚboolrr1r2Úsetrrrr)r r2r3rrrrr:jszEnvironmentFile.setc@sZeZdZddd„Zdd„Zdd„Zdd „Zd d„Zedd „ƒZ edd„ƒZ edd„ƒZdS)zEnvironmentFile.LineNcCs(||_||_||_||_||_||_dS)N)rrr2r3ÚoriginalÚfmt)r rrr2r3r;r<rrrrxszEnvironmentFile.Line.__init__cCs |jdk S)N)r<)r rrrr1szEnvironmentFile.Line.isVariablecCs |jdk S)N)r;)r rrrÚ isOriginal„szEnvironmentFile.Line.isOriginalcCs&||_||_|jdkr"d|j|_dS)Nz${name}%s${value} )r2r3r<r)r r2r3rrrr:‡s zEnvironmentFile.Line.setcCsp|jƒr|jS|jdk r|jnd}|j|j||jƒdœ}|j}x,|jƒD] \}}|jd|dt |ƒƒ}qHW|S)Nr)r2r3z${ú}) r=r;r3r2ÚEscaperr<ÚitemsÚreplaceÚstr)r r3ZreplacementrÚkeyrrrrszEnvironmentFile.Line.getLinecCsŽ|j|ƒ}|jdƒs$|jƒs$|r4tj|||dS|jdƒ}tjj|jdƒ|ƒ}d|jdƒ|jdƒ|jdƒ|jd ƒf}tj|||||d S)Nú#)r;ééz%s${name}%s%s%s${value} éééé)r2r3r<)ÚmatchÚ startswithÚstriprrÚgroupÚUnescape)rrrrrKr2r3r<rrrrs zEnvironmentFile.Line.ParsecCsŒ|dkrdSt|ƒ}|jddƒ}|jddƒ}|jddƒ}|jdd ƒ}|jd dƒ}|jdd ƒ}|rˆ|jdƒdks||jdƒdkrˆd|d}|S)Nrú\z\\ú"z\"ú'z\'ú$z\$ú~z\~ú`z\`ú rú )rBrAÚfind)r3rrrrr?szEnvironmentFile.Line.EscapecCs¾|s|St|ƒ}t|ƒ}|rX|ddks4|ddkrX|d||dkrX|d|d…}d}x\|jd|ƒ}|dkrtP|dt|ƒkr’|d|…}P|d|…||dd…}|d7}q^W|S)NrrQrRrGrP)rBÚlenrX)r3rZlengthÚirrrrOÀs$,zEnvironmentFile.Line.Unescape)NNNN)Ú__name__Ú __module__Ú__qualname__rr1r=r:rÚstaticmethodrr?rOrrrrrws r)rNT)N)r[r\r]rrrr(r6r7r:rrrrrrs r)r&r rrrrrrÚsPKEhe[Hm;¹¬6¬6authcompat_Options.pynu„[µü¤# -*- coding: utf-8 -*- # # Authors: # Pavel BÅ™ezina # # Copyright (C) 2018 Red Hat # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for morerequi details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import argparse import gettext _ = gettext.gettext class Option: def __init__(self, name, metavar, help, feature, supported): self.name = name self.metavar = metavar self.help = help self.feature = feature self.supported = supported self.value = None self.from_sysconfig = False def set(self, new_value): self.value = new_value def set_from_sysconfig(self, new_value): self.set(new_value) self.from_sysconfig = True def isset(self): return self.value is not None @staticmethod def Valued(name, metavar, help): return Option(name, metavar, help, feature=False, supported=True) @staticmethod def Switch(name, help): return Option(name, None, help, feature=False, supported=True) @staticmethod def Feature(name, help): return Option(name, None, help, feature=True, supported=True) @staticmethod def UnsupportedValued(name, metavar): return Option(name, metavar, None, feature=False, supported=False) @staticmethod def UnsupportedFeature(name): return Option(name, None, None, feature=True, supported=False) @staticmethod def UnsupportedSwitch(name): return Option(name, None, None, feature=False, supported=False) class Options: List = [ # These options are still supported in authconfig compatibility # layers. The tool will do its best to translate them to authselect # call and where needed, it will generate a configuration file. # # However, they will just make sure that an authentication against # expected service is working. They may not result in the exact same # configuration as authconfig would generate. Option.Feature("nis", _("NIS for user information by default")), Option.Valued("nisdomain", _(""), _("default NIS domain")), Option.Valued("nisserver", _(""), _("default NIS server")), Option.Feature("ldap", _("LDAP for user information by default")), Option.Feature("ldapauth", _("LDAP for authentication by default")), Option.Valued("ldapserver", _(""), _("default LDAP server hostname or URI")), Option.Valued("ldapbasedn", _(""), _("default LDAP base DN")), Option.Feature("ldaptls", _("use of TLS with LDAP (RFC-2830)")), Option.Feature("ldapstarttls", _("use of TLS for identity lookups with LDAP (RFC-2830)")), Option.Feature("rfc2307bis", _("use of RFC-2307bis schema for LDAP user information lookups")), Option.Feature("smartcard", _("authentication with smart card by default")), Option.Valued("smartcardaction", _("<0=Lock|1=Ignore>"), _("action to be taken on smart card removal")), Option.Feature("requiresmartcard", _("require smart card for authentication by default")), Option.Feature("fingerprint", _("authentication with fingerprint readers by default")), Option.Feature("krb5", _("Kerberos authentication by default")), Option.Valued("krb5kdc", _(""), _("default Kerberos KDC")), Option.Valued("krb5adminserver", _(""), _("default Kerberos admin server")), Option.Valued("krb5realm", _(""), _("default Kerberos realm")), Option.Feature("krb5kdcdns", _("use of DNS to find Kerberos KDCs")), Option.Feature("krb5realmdns", _("use of DNS to find Kerberos realms")), Option.Feature("winbind", _("winbind for user information by default")), Option.Feature("winbindauth", _("winbind for authentication by default")), Option.Valued("winbindjoin", _(""), _("join the winbind domain or ads realm now as this administrator")), Option.Feature("winbindkrb5", _("Kerberos 5 for authenticate with winbind")), Option.Valued("smbworkgroup", _(""), _("workgroup authentication servers are in")), Option.Feature("sssd", _("SSSD for user information by default with manually managed configuration")), Option.Feature("sssdauth", _("SSSD for authentication by default with manually managed configuration")), Option.Feature("cachecreds", _("caching of user credentials in SSSD by default")), Option.Feature("pamaccess", _("check of access.conf during account authorization")), Option.Feature("mkhomedir", _("creation of home directories for users on their first login")), Option.Feature("faillock", _("account locking in case of too many consecutive authentication failures")), Option.Valued("passminlen", _(""), _("minimum length of a password")), Option.Valued("passminclass", _(""), _("minimum number of character classes in a password")), Option.Valued("passmaxrepeat", _(""), _("maximum number of same consecutive characters in a password")), Option.Valued("passmaxclassrepeat", _(""), _("maximum number of consecutive characters of same class in a password")), Option.Feature("reqlower", _("require at least one lowercase character in a password")), Option.Feature("requpper", _("require at least one uppercase character in a password")), Option.Feature("reqdigit", _("require at least one digit in a password")), Option.Feature("reqother", _("require at least one other character in a password")), # Program options Option.Switch("nostart", _("do not start/stop services")), Option.Switch("updateall", _("update all configuration files")), Option.Switch("update", _("the same as --updateall")), Option.Switch("kickstart", _("the same as --updateall")), # Hidden compat tool option, useful for testing. No changes to the # system will be done, they will be printed. Option.Switch("test-call", argparse.SUPPRESS), # Unsupported program options but we have to react somehow when set Option.UnsupportedSwitch("test"), Option.UnsupportedSwitch("probe"), Option.UnsupportedValued("savebackup", _("")), Option.UnsupportedValued("restorebackup", _("")), Option.UnsupportedSwitch("restorelastbackup"), # These options are no longer supported in authconfig compatibility # layers and will produce warning when used. They will not affect # the system. Option.UnsupportedFeature("cache"), Option.UnsupportedFeature("ecryptfs"), Option.UnsupportedFeature("shadow"), Option.UnsupportedSwitch("useshadow"), Option.UnsupportedFeature("md5"), Option.UnsupportedSwitch("usemd5"), Option.UnsupportedValued("passalgo", _("")), Option.UnsupportedValued("ldaploadcacert", _("")), Option.UnsupportedValued("smartcardmodule", _("")), Option.UnsupportedValued("smbsecurity", _("")), Option.UnsupportedValued("smbrealm", _("")), Option.UnsupportedValued("smbservers", _("")), Option.UnsupportedValued("smbidmaprange", _("")), Option.UnsupportedValued("smbidmapuid", _("")), Option.UnsupportedValued("smbidmapgid", _("")), Option.UnsupportedValued("winbindseparator", _("<\\>")), Option.UnsupportedValued("winbindtemplatehomedir", _("")), Option.UnsupportedValued("winbindtemplateshell", _("")), Option.UnsupportedFeature("winbindusedefaultdomain"), Option.UnsupportedFeature("winbindoffline"), Option.UnsupportedFeature("preferdns"), Option.UnsupportedFeature("forcelegacy"), Option.UnsupportedFeature("locauthorize"), Option.UnsupportedFeature("sysnetauth"), Option.UnsupportedValued("faillockargs", _("")), ] Map = { # These options were use with autodetection of pam_cracklib # and pam_passwdqc. However, authselect supports only pam_pwquality. # "USEPWQUALITY" : "", # "USEPASSWDQC" : "", "USEFAILLOCK": "faillock", "FAILLOCKARGS": "faillockargs", "USELDAP": "ldap", "USENIS": "nis", "USEECRYPTFS": "ecryptfs", "USEWINBIND": "winbind", "WINBINDKRB5": "winbindkrb5", "USESSSD": "sssd", "USEKERBEROS": "krb5", "USELDAPAUTH": "ldapauth", "USESMARTCARD": "smartcard", "FORCESMARTCARD": "requiresmartcard", "USEFPRINTD": "fingerprint", "PASSWDALGORITHM": "passalgo", "USEMD5": "md5", "USESHADOW": "shadow", "USEWINBINDAUTH": "winbindauth", "USESSSDAUTH": "sssdauth", "USELOCAUTHORIZE": "locauthorize", "USEPAMACCESS": "pamaccess", "USEMKHOMEDIR": "mkhomedir", "USESYSNETAUTH": "sysnetauth", "FORCELEGACY": "forcelegacy", "CACHECREDENTIALS": "cachecreds", } def __init__(self): self.options = {} for option in self.List: self.options[option.name] = option def parse(self): parser = argparse.ArgumentParser(description='Authconfig Compatibility Tool.') parsers = { 'supported': parser.add_argument_group(_('These options have a compatibility layer')), 'unsupported': parser.add_argument_group(_('These options are no longer supported and have no effect')) } for option in self.List: group = 'supported' if option.supported else 'unsupported' self.add_option(parsers[group], option) cmdline = parser.parse_args() for name, option in self.options.items(): value = getattr(cmdline, name) option.set(value) # usemd5 and useshadow are equivalent to enablemd5 and enableshadow if not self.isset('md5') and self.isset('usemd5'): self.set('md5', self.get('usemd5')) if not self.isset('shadow') and self.isset('useshadow'): self.set('shadow', self.get('useshadow')) # ldapstarttls is equivalent to ldaptls if self.isset('ldapstarttls') and not self.isset('ldaptls'): self.set('ldaptls', self.get('ldapstarttls')) def applysysconfig(self, sysconfig): for name, option in self.Map.items(): if not self.isset(option): self.options[option].set_from_sysconfig(sysconfig.get(name)) def updatesysconfig(self, sysconfig): for name, option in self.Map.items(): if self.isset(option): sysconfig.set(name, self.get(option)) def get(self, name): return self.options[name].value def set(self, name, value): self.options[name].set(value) def isset(self, name): return self.options[name].isset() def getBool(self, name): value = self.get(name) if value is None or not value: return False return True def getTrueOrNone(self, name): value = self.get(name) if value is None or not value: return None return True def getSetButUnsupported(self): options = [] for option in Options.List: if option.supported: continue if not option.isset(): continue if option.from_sysconfig: continue name = option.name if option.feature: name = "enable" + name if option.value else "disable" + name options.append(name) return options def add_option(self, parser, option): if option.metavar is not None: self.add_valued(parser, option) elif option.feature: self.add_feature(parser, option) else: self.add_switch(parser, option) def add_valued(self, parser, option): parser.add_argument("--" + option.name, action='store', help=option.help, dest=option.name, metavar=option.metavar) def add_switch(self, parser, option): parser.add_argument("--" + option.name, action='store_const', const=True, help=option.help, dest=option.name) def add_feature(self, parser, option): help_enable = None help_disable = None if option.help is not None: help_enable = _("enable") + " " + option.help help_disable = _("disable") + " " + option.help parser.add_argument("--enable" + option.name, action='store_const', const=True, help=help_enable, dest=option.name) parser.add_argument("--disable" + option.name, action='store_const', const=False, help=help_disable, dest=option.name) PKEhe[Åî#‚authcompat_ConfigSnippet.pynu„[µü¤PKEhe[Ý›lÐ)V)V Lauthcompat.pynuÈ¯ÝíPKEhe[ªOLL²aauthcompat_EnvironmentFile.pynu„[µü¤PKEhe[2sŠèööK|snippets/authconfig-krb.confnu„[µü¤PKEhe[26ÒÒ}snippets/authconfig-sssd.confnu„[µü¤PKEhe[˜Ès"9¬__pycache__/authcompat_ConfigSnippet.cpython-36.opt-1.pycnu„[µü¤PKEhe[‚¦àÚ'Ú'-+‡__pycache__/authcompat_Options.cpython-36.pycnu„[µü¤PKEhe[êâðÐcc5b¯__pycache__/authcompat_EnvironmentFile.cpython-36.pycnu„[µü¤PKEhe[ü¿À¬´M´M+*Ã__pycache__/authcompat.cpython-36.opt-1.pycnu„[µü¤PKEhe[‚¦àÚ'Ú'39__pycache__/authcompat_Options.cpython-36.opt-1.pycnu„[µü¤PKEhe[ü¿À¬´M´M%v9__pycache__/authcompat.cpython-36.pycnu„[µü¤PKEhe[˜Ès"3‡__pycache__/authcompat_ConfigSnippet.cpython-36.pycnu„[µü¤PKEhe[êâðÐcc;øŽ__pycache__/authcompat_EnvironmentFile.cpython-36.opt-1.pycnu„[µü¤PKEhe[Hm;¹¬6¬6Æ¢authcompat_Options.pynu„[µü¤PKŸ·Ù