ExternalMirrors
/
users-formula
mirror of https://github.com/saltstack-formulas/users-formula
Watch 1
Star 0
Fork 1
Code Issues 0 Releases 13 Wiki Activity
Saltstack Official Users Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
204 Commits
3 Branches
Tree: 4b840e646c
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '4b840e646c'
${ noResults }
users-formula/users/init.sls

482 lines
14KB
Raw Blame History 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. 

  7. {%- for name, user in pillar.get('users', {}).items()

  8.         if user.absent is not defined or not user.absent %}

  9. {%- if user == None -%}

  10. {%- set user = {} -%}

  11. {%- endif -%}

  12. {%- if 'sudouser' in user and user['sudouser'] %}

  13. {%- do used_sudo.append(1) %}

  14. {%- endif %}

  15. {%- if 'google_auth' in user %}

  16. {%- do used_googleauth.append(1) %}

  17. {%- endif %}

  18. {%- if salt['pillar.get']('users:' ~ name ~ ':user_files:enabled', False) %}

  19. {%- do used_user_files.append(1) %}

  20. {%- endif %}

  21. {%- endfor %}

  22. 

  23. {%- if used_sudo or used_googleauth or used_user_files %}

  24. include:

  25. {%- if used_sudo %}

  26.   - users.sudo

  27. {%- endif %}

  28. {%- if used_googleauth %}

  29.   - users.googleauth

  30. {%- endif %}

  31. {%- if used_user_files %}

  32.   - users.user_files

  33. {%- endif %}

  34. {%- endif %}

  35. 

  36. {% for name, user in pillar.get('users', {}).items()

  37.         if user.absent is not defined or not user.absent %}

  38. {%- if user == None -%}

  39. {%- set user = {} -%}

  40. {%- endif -%}

  41. {%- set home = user.get('home', "/home/%s" % name) -%}

  42. 

  43. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  44. {%- set user_group = user.prime_group.name -%}

  45. {%- else -%}

  46. {%- set user_group = name -%}

  47. {%- endif %}

  48. 

  49. {% for group in user.get('groups', []) %}

  50. users_{{ name }}_{{ group }}_group:

  51.   group.present:

  52.     - name: {{ group }}

  53.     {% if group == 'sudo' %}

  54.     - system: True

  55.     {% endif %}

  56. {% endfor %}

  57. 

  58. users_{{ name }}_user:

  59.   {% if user.get('createhome', True) %}

  60.   file.directory:

  61.     - name: {{ home }}

  62.     - user: {{ name }}

  63.     - group: {{ user_group }}

  64.     - mode: {{ user.get('user_dir_mode', '0750') }}

  65.     - require:

  66.       - user: users_{{ name }}_user

  67.       - group: {{ user_group }}

  68.   {%- endif %}

  69.   group.present:

  70.     - name: {{ user_group }}

  71.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  72.     - gid: {{ user['prime_group']['gid'] }}

  73.     {%- elif 'uid' in user %}

  74.     - gid: {{ user['uid'] }}

  75.     {%- endif %}

  76.     {% if 'system' in user and user['system'] %}

  77.     - system: True

  78.     {% endif %}

  79.   user.present:

  80.     - name: {{ name }}

  81.     - home: {{ home }}

  82.     - shell: {{ user.get('shell', users.get('shell', '/bin/bash')) }}

  83.     {% if 'uid' in user -%}

  84.     - uid: {{ user['uid'] }}

  85.     {% endif -%}

  86.     {% if 'password' in user -%}

  87.     - password: '{{ user['password'] }}'

  88.     {% endif -%}

  89.     {% if user.get('empty_password') -%}

  90.     - empty_password: {{ user.get('empty_password') }}

  91.     {% endif -%}

  92.     {% if 'enforce_password' in user -%}

  93.     - enforce_password: {{ user['enforce_password'] }}

  94.     {% endif -%}

  95.     {% if user.get('system', False) -%}

  96.     - system: True

  97.     {% endif -%}

  98.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  99.     - gid: {{ user['prime_group']['gid'] }}

  100.     {% else -%}

  101.     - gid_from_name: True

  102.     {% endif -%}

  103.     {% if 'fullname' in user %}

  104.     - fullname: {{ user['fullname'] }}

  105.     {% endif -%}

  106.     {% if 'roomnumber' in user %}

  107.     - roomnumber: {{ user['roomnumber'] }}

  108.     {% endif %}

  109.     {% if 'workphone' in user %}

  110.     - workphone: {{ user['workphone'] }}

  111.     {% endif %}

  112.     {% if 'homephone' in user %}

  113.     - homephone: {{ user['workphone'] }}

  114.     {% endif %}

  115.     {% if not user.get('createhome', True) %}

  116.     - createhome: False

  117.     {% endif %}

  118.     {% if 'expire' in user -%}

  119.         {% if grains['kernel'].endswith('BSD') and

  120.             user['expire'] < 157766400 %}

  121.         {# 157762800s since epoch equals 01 Jan 1975 00:00:00 UTC #}

  122.     - expire: {{ user['expire'] * 86400 }}

  123.         {% elif grains['kernel'] == 'Linux' and

  124.             user['expire'] > 84006 %}

  125.         {# 2932896 days since epoch equals 9999-12-31 #}

  126.     - expire: {{ (user['expire'] / 86400) | int}}

  127.         {% else %}

  128.     - expire: {{ user['expire'] }}

  129.         {% endif %}

  130.     {% endif -%}

  131.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  132.     - groups:

  133.       - {{ user_group }}

  134.       {% for group in user.get('groups', []) -%}

  135.       - {{ group }}

  136.       {% endfor %}

  137.     - require:

  138.       - group: {{ user_group }}

  139.       {% for group in user.get('groups', []) -%}

  140.       - group: {{ group }}

  141.       {% endfor %}

  142. 

  143. 

  144.   {% if 'ssh_keys' in user or

  145.       'ssh_auth' in user or

  146.       'ssh_auth_file' in user or

  147.       'ssh_auth_pillar' in user or

  148.       'ssh_auth.absent' in user or

  149.       'ssh_config' in user %}

  150. user_keydir_{{ name }}:

  151.   file.directory:

  152.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh

  153.     - user: {{ name }}

  154.     - group: {{ user_group }}

  155.     - makedirs: True

  156.     - mode: 700

  157.     - require:

  158.       - user: {{ name }}

  159.       - group: {{ user_group }}

  160.       {%- for group in user.get('groups', []) %}

  161.       - group: {{ group }}

  162.       {%- endfor %}

  163.   {% endif %}

  164. 

  165.   {% if 'ssh_keys' in user %}

  166.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  167. users_user_{{ name }}_private_key:

  168.   file.managed:

  169.     - name: {{ user.get('home',

  170.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}

  171.     - user: {{ name }}

  172.     - group: {{ user_group }}

  173.     - mode: 600

  174.     - show_diff: False

  175.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  176.     - require:

  177.       - user: users_{{ name }}_user

  178.       {% for group in user.get('groups', []) %}

  179.       - group: users_{{ name }}_{{ group }}_group

  180.       {% endfor %}

  181. users_user_{{ name }}_public_key:

  182.   file.managed:

  183.     - name: {{ user.get('home',

  184.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}.pub

  185.     - user: {{ name }}

  186.     - group: {{ user_group }}

  187.     - mode: 644

  188.     - show_diff: False

  189.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  190.     - require:

  191.       - user: users_{{ name }}_user

  192.       {% for group in user.get('groups', []) %}

  193.       - group: users_{{ name }}_{{ group }}_group

  194.       {% endfor %}

  195.   {% endif %}

  196. 

  197. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  198. users_authorized_keys_{{ name }}:

  199.   file.managed:

  200.     - name: {{ home }}/.ssh/authorized_keys

  201.     - user: {{ name }}

  202.     - group: {{ user_group }}

  203.     - mode: 600

  204. {% if 'ssh_auth_file' in user %}

  205.     - contents: |

  206.         {% for auth in user.ssh_auth_file -%}

  207.         {{ auth }}

  208.         {% endfor -%}

  209. {% else %}

  210.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].items() %}

  211.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  212.         {%- endfor %}

  213. {% endif %}

  214. {% endif %}

  215. 

  216. {% if 'ssh_auth' in user %}

  217. {% for auth in user['ssh_auth'] %}

  218. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  219.   ssh_auth.present:

  220.     - user: {{ name }}

  221.     - name: {{ auth }}

  222.     - require:

  223.         - file: user_keydir_{{ name }}

  224.         - user: users_{{ name }}_user

  225. {% endfor %}

  226. {% endif %}

  227. 

  228. {% if 'ssh_keys_pillar' in user %}

  229. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  230. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  231.   file.managed:

  232.     - name: {{ user.get('home',

  233.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}

  234.     - user: {{ name }}

  235.     - group: {{ user_group }}

  236.     - mode: 600

  237.     - show_diff: False

  238.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  239.     - require:

  240.       - user: users_{{ name }}_user

  241.       {% for group in user.get('groups', []) %}

  242.       - group: users_{{ name }}_{{ group }}_group

  243.       {% endfor %}

  244. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  245.   file.managed:

  246.     - name: {{ user.get('home',

  247.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}.pub

  248.     - user: {{ name }}

  249.     - group: {{ user_group }}

  250.     - mode: 644

  251.     - show_diff: False

  252.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  253.     - require:

  254.       - user: users_{{ name }}_user

  255.       {% for group in user.get('groups', []) %}

  256.       - group: users_{{ name }}_{{ group }}_group

  257.       {% endfor %}

  258. {% endfor %}

  259. {% endif %}

  260. 

  261. {% if 'ssh_auth_sources' in user %}

  262. {% for pubkey_file in user['ssh_auth_sources'] %}

  263. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  264.   ssh_auth.present:

  265.     - user: {{ name }}

  266.     - source: {{ pubkey_file }}

  267.     - require:

  268.         - file: users_{{ name }}_user

  269.         - user: users_{{ name }}_user

  270. {% endfor %}

  271. {% endif %}

  272. 

  273. {% if 'ssh_auth.absent' in user %}

  274. {% for auth in user['ssh_auth.absent'] %}

  275. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  276.   ssh_auth.absent:

  277.     - user: {{ name }}

  278.     - name: {{ auth }}

  279.     - require:

  280.         - file: users_{{ name }}_user

  281.         - user: users_{{ name }}_user

  282. {% endfor %}

  283. {% endif %}

  284. 

  285. {% if 'ssh_config' in user %}

  286. users_ssh_config_{{ name }}:

  287.   file.managed:

  288.     - name: {{ home }}/.ssh/config

  289.     - user: {{ name }}

  290.     - group: {{ user_group }}

  291.     - mode: 640

  292.     - contents: |

  293.         # Managed by Saltstack

  294.         # Do Not Edit

  295.         {% for label, setting in user.ssh_config.items() %}

  296.         # {{ label }}

  297.         Host {{ setting.get('hostname') }}

  298.           {%- for opts in setting.get('options') %}

  299.           {{ opts }}

  300.           {%- endfor %}

  301.         {% endfor -%}

  302. {% endif %}

  303. 

  304. {% if 'ssh_known_hosts' in user %}

  305. {% for hostname, host in user['ssh_known_hosts'].items() %}

  306. users_ssh_known_hosts_{{ name }}_{{ loop.index0 }}:

  307.   ssh_known_hosts.present:

  308.     - user: {{ name }}

  309.     - name: {{ hostname }}

  310.     {% if 'port' in host %}

  311.     - port: {{ host['port'] }}

  312.     {% endif -%}

  313.     {% if 'fingerprint' in host %}

  314.     - fingerprint: {{ host['fingerprint'] }}

  315.     {% endif -%}

  316.     {% if 'key' in host %}

  317.     - key: {{ host['key'] }}

  318.     {% endif -%}

  319.     {% if 'enc' in host %}

  320.     - enc: {{ host['enc'] }}

  321.     {% endif -%}

  322.     {% if 'hash_hostname' in host %}

  323.     - hash_hostname: {{ host['hash_hostname'] }}

  324.     {% endif -%}

  325. {% endfor %}

  326. {% endif %}

  327. 

  328. {% if 'ssh_known_hosts.absent' in user %}

  329. {% for host in user['ssh_known_hosts.absent'] %}

  330. users_ssh_known_hosts_delete_{{ name }}_{{ loop.index0 }}:

  331.   ssh_known_hosts.absent:

  332.     - user: {{ name }}

  333.     - name: {{ host }}

  334. {% endfor %}

  335. {% endif %}

  336. 

  337. {% if 'sudouser' in user and user['sudouser'] %}

  338. 

  339. users_sudoer-{{ name }}:

  340.   file.managed:

  341.     - name: {{ users.sudoers_dir }}/{{ name }}

  342.     - user: root

  343.     - group: {{ users.root_group }}

  344.     - mode: '0440'

  345. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  346. #{#%

  347. {% if 'sudo_rules' in user %}

  348. {% for rule in user['sudo_rules'] %}

  349. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  350.   cmd.run:

  351.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  352.     - stateful: True

  353.     - shell: {{ users.visudo_shell }}

  354.     - env:

  355.       # Specify the rule via an env var to avoid shell quoting issues.

  356.       - rule: "{{ name }} {{ rule }}"

  357.     - require_in:

  358.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  359. {% endfor %}

  360. {% endif %}

  361. {% if 'sudo_defaults' in user %}

  362. {% for entry in user['sudo_defaults'] %}

  363. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  364.   cmd.run:

  365.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  366.     - stateful: True

  367.     - shell: {{ users.visudo_shell }}

  368.     - env:

  369.       # Specify the rule via an env var to avoid shell quoting issues.

  370.       - rule: "Defaults:{{ name }} {{ entry }}"

  371.     - require_in:

  372.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  373. {% endfor %}

  374. {% endif %}

  375. #%#}

  376. 

  377. users_{{ users.sudoers_dir }}/{{ name }}:

  378.   file.managed:

  379.     - name: {{ users.sudoers_dir }}/{{ name }}

  380.     - contents: |

  381.       {%- if 'sudo_defaults' in user %}

  382.       {%- for entry in user['sudo_defaults'] %}

  383.         Defaults:{{ name }} {{ entry }}

  384.       {%- endfor %}

  385.       {%- endif %}

  386.       {%- if 'sudo_rules' in user %}

  387.       {%- for rule in user['sudo_rules'] %}

  388.         {{ name }} {{ rule }}

  389.       {%- endfor %}

  390.       {%- endif %}

  391.     - require:

  392.       - file: users_sudoer-defaults

  393.       - file: users_sudoer-{{ name }}

  394.   cmd.wait:                                                                           

  395.     - name: visudo -cf {{ users.sudoers_dir }}/{{ name }} || ( rm -rvf {{ users.sudoers_dir }}/{{ name }}; exit 1 )

  396.     - watch:                                                                         

  397.       - file: {{ users.sudoers_dir }}/{{ name }}   

  398. {% endif %}

  399. {% else %}

  400. users_{{ users.sudoers_dir }}/{{ name }}:

  401.   file.absent:

  402.     - name: {{ users.sudoers_dir }}/{{ name }}

  403. {% endif %}

  404. 

  405. {%- if 'google_auth' in user %}

  406. {%- for svc in user['google_auth'] %}

  407. users_googleauth-{{ svc }}-{{ name }}:

  408.   file.managed:

  409.     - replace: false

  410.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  411.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  412.     - user: root

  413.     - group: {{ users.root_group }}

  414.     - mode: 400

  415.     - require:

  416.       - pkg: users_googleauth-package

  417. {%- endfor %}

  418. {%- endif %}

  419. 

  420. {% if 'gitconfig' in user %}

  421. {% if not salt['cmd.has_exec']('git') %}

  422. skip_{{ name }}_gitconfig_since_git_not_installed:

  423.   test.fail_without_changes:

  424.     - name: "Git configuration for user {{ name }} has been skipped because Git is not installed."

  425. {% else %}

  426. {% for key, value in user['gitconfig'].items() %}

  427. users_{{ name }}_user_gitconfig_{{ loop.index0 }}:

  428.   {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  429.   git.config_set:

  430.   {% else %}

  431.   git.config:

  432.   {% endif %}

  433.     - name: {{ key }}

  434.     - value: "{{ value }}"

  435.     - user: {{ name }}

  436.     {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  437.     - global: True

  438.     {% else %}

  439.     - is_global: True

  440.     {% endif %}

  441. {% endfor %}

  442. {% endif %}

  443. {% endif %}

  444. 

  445. {% endfor %}

  446. 

  447. 

  448. {% for name, user in pillar.get('users', {}).items()

  449.         if user.absent is defined and user.absent %}

  450. users_absent_user_{{ name }}:

  451. {% if 'purge' in user or 'force' in user %}

  452.   user.absent:

  453.     - name: {{ name }}

  454.     {% if 'purge' in user %}

  455.     - purge: {{ user['purge'] }}

  456.     {% endif %}

  457.     {% if 'force' in user %}

  458.     - force: {{ user['force'] }}

  459.     {% endif %}

  460. {% else %}

  461.   user.absent:

  462.     - name: {{ name }}

  463. {% endif -%}

  464. users_{{ users.sudoers_dir }}/{{ name }}:

  465.   file.absent:

  466.     - name: {{ users.sudoers_dir }}/{{ name }}

  467. {% endfor %}

  468. 

  469. {% for user in pillar.get('absent_users', []) %}

  470. users_absent_user_2_{{ user }}:

  471.   user.absent

  472. users_2_{{ users.sudoers_dir }}/{{ user }}:

  473.   file.absent:

  474.     - name: {{ users.sudoers_dir }}/{{ user }}

  475. {% endfor %}

  476. 

  477. {% for group in pillar.get('absent_groups', []) %}

  478. users_absent_group_{{ group }}:

  479.   group.absent:

  480.     - name: {{ group }}

  481. {% endfor %}