ExternalMirrors
/
users-formula
zrcadlo https://github.com/saltstack-formulas/users-formula
Sledovat 1
Oblíbit 0
Rozštěpit 1
Zdrojový kód Úkoly 0 Vydání 13 Wiki Aktivita
Saltstack Official Users Formula
Nelze vybrat více než 25 témat Téma musí začínat písmenem nebo číslem, může obsahovat pomlčky („-“) a může být dlouhé až 35 znaků.
220 Revize
3 Větve
Strom: c98aa35392
Větve Značky
${ item.name }
Vytvořit větev ${ searchTerm }
z „c98aa35392“
${ noResults }
users-formula/users/init.sls

502 lines
14KB
Surový Blame Historie 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. 

  7. {%- for name, user in pillar.get('users', {}).items()

  8.         if user.absent is not defined or not user.absent %}

  9. {%- if user == None -%}

  10. {%- set user = {} -%}

  11. {%- endif -%}

  12. {%- if 'sudouser' in user and user['sudouser'] %}

  13. {%- do used_sudo.append(1) %}

  14. {%- endif %}

  15. {%- if 'google_auth' in user %}

  16. {%- do used_googleauth.append(1) %}

  17. {%- endif %}

  18. {%- if salt['pillar.get']('users:' ~ name ~ ':user_files:enabled', False) %}

  19. {%- do used_user_files.append(1) %}

  20. {%- endif %}

  21. {%- endfor %}

  22. 

  23. {%- if used_sudo or used_googleauth or used_user_files %}

  24. include:

  25. {%- if used_sudo %}

  26.   - users.sudo

  27. {%- endif %}

  28. {%- if used_googleauth %}

  29.   - users.googleauth

  30. {%- endif %}

  31. {%- if used_user_files %}

  32.   - users.user_files

  33. {%- endif %}

  34. {%- endif %}

  35. 

  36. {% for name, user in pillar.get('users', {}).items()

  37.         if user.absent is not defined or not user.absent %}

  38. {%- if user == None -%}

  39. {%- set user = {} -%}

  40. {%- endif -%}

  41. {%- set current = salt.user.info(name) -%}

  42. {%- set home = user.get('home', current.get('home', "/home/%s" % name)) -%}

  43. 

  44. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  45. {%- set user_group = user.prime_group.name -%}

  46. {%- else -%}

  47. {%- set user_group = name -%}

  48. {%- endif %}

  49. 

  50. {% for group in user.get('groups', []) %}

  51. users_{{ name }}_{{ group }}_group:

  52.   group.present:

  53.     - name: {{ group }}

  54.     {% if group == 'sudo' %}

  55.     - system: True

  56.     {% endif %}

  57. {% endfor %}

  58. 

  59. users_{{ name }}_user:

  60.   {% if user.get('createhome', True) %}

  61.   file.directory:

  62.     - name: {{ home }}

  63.     - user: {{ name }}

  64.     - group: {{ user_group }}

  65.     - mode: {{ user.get('user_dir_mode', '0750') }}

  66.     - require:

  67.       - user: users_{{ name }}_user

  68.       - group: {{ user_group }}

  69.   {%- endif %}

  70.   group.present:

  71.     - name: {{ user_group }}

  72.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  73.     - gid: {{ user['prime_group']['gid'] }}

  74.     {%- elif 'uid' in user %}

  75.     - gid: {{ user['uid'] }}

  76.     {%- endif %}

  77.     {% if 'system' in user and user['system'] %}

  78.     - system: True

  79.     {% endif %}

  80.   user.present:

  81.     - name: {{ name }}

  82.     - home: {{ home }}

  83.     - shell: {{ user.get('shell', current.get('shell', users.get('shell', '/bin/bash'))) }}

  84.     {% if 'uid' in user -%}

  85.     - uid: {{ user['uid'] }}

  86.     {% endif -%}

  87.     {% if 'password' in user -%}

  88.     - password: '{{ user['password'] }}'

  89.     {% endif -%}

  90.     {% if user.get('empty_password') -%}

  91.     - empty_password: {{ user.get('empty_password') }}

  92.     {% endif -%}

  93.     {% if 'enforce_password' in user -%}

  94.     - enforce_password: {{ user['enforce_password'] }}

  95.     {% endif -%}

  96.     {% if user.get('system', False) -%}

  97.     - system: True

  98.     {% endif -%}

  99.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  100.     - gid: {{ user['prime_group']['gid'] }}

  101.     {% else -%}

  102.     - gid_from_name: True

  103.     {% endif -%}

  104.     {% if 'fullname' in user %}

  105.     - fullname: {{ user['fullname'] }}

  106.     {% endif -%}

  107.     {% if 'roomnumber' in user %}

  108.     - roomnumber: {{ user['roomnumber'] }}

  109.     {% endif %}

  110.     {% if 'workphone' in user %}

  111.     - workphone: {{ user['workphone'] }}

  112.     {% endif %}

  113.     {% if 'homephone' in user %}

  114.     - homephone: {{ user['workphone'] }}

  115.     {% endif %}

  116.     {% if not user.get('createhome', True) %}

  117.     - createhome: False

  118.     {% endif %}

  119.     {% if 'expire' in user -%}

  120.         {% if grains['kernel'].endswith('BSD') and

  121.             user['expire'] < 157766400 %}

  122.         {# 157762800s since epoch equals 01 Jan 1975 00:00:00 UTC #}

  123.     - expire: {{ user['expire'] * 86400 }}

  124.         {% elif grains['kernel'] == 'Linux' and

  125.             user['expire'] > 84006 %}

  126.         {# 2932896 days since epoch equals 9999-12-31 #}

  127.     - expire: {{ (user['expire'] / 86400) | int}}

  128.         {% else %}

  129.     - expire: {{ user['expire'] }}

  130.         {% endif %}

  131.     {% endif -%}

  132.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  133.     - groups:

  134.       - {{ user_group }}

  135.       {% for group in user.get('groups', []) -%}

  136.       - {{ group }}

  137.       {% endfor %}

  138.     {% if 'optional_groups' in user %}

  139.     - optional_groups:

  140.       {% for optional_group in user['optional_groups'] -%}

  141.       - {{optional_group}}

  142.       {% endfor %}

  143.     {% endif %}

  144.     - require:

  145.       - group: {{ user_group }}

  146.       {% for group in user.get('groups', []) -%}

  147.       - group: {{ group }}

  148.       {% endfor %}

  149. 

  150. 

  151.   {% if 'ssh_keys' in user or

  152.       'ssh_auth' in user or

  153.       'ssh_auth_file' in user or

  154.       'ssh_auth_pillar' in user or

  155.       'ssh_auth.absent' in user or

  156.       'ssh_config' in user %}

  157. user_keydir_{{ name }}:

  158.   file.directory:

  159.     - name: {{ home }}/.ssh

  160.     - user: {{ name }}

  161.     - group: {{ user_group }}

  162.     - makedirs: True

  163.     - mode: 700

  164.     - require:

  165.       - user: {{ name }}

  166.       - group: {{ user_group }}

  167.       {%- for group in user.get('groups', []) %}

  168.       - group: {{ group }}

  169.       {%- endfor %}

  170.   {% endif %}

  171. 

  172.   {% if 'ssh_keys' in user %}

  173.     {% for _key in user.ssh_keys.keys() %}

  174.       {% if _key == 'privkey' %}

  175.         {% set key_name = 'id_' + user.get('ssh_key_type', 'rsa') %}

  176.       {% elif _key ==  'pubkey' %}

  177.         {% set key_name = 'id_' + user.get('ssh_key_type', 'rsa') + '.pub' %}

  178.       {% else %}

  179.         {% set key_name = _key %}

  180.       {% endif %}

  181. users_{{ name }}_{{ key_name }}_private_key:

  182.   file.managed:

  183.     - name: {{ home }}/.ssh/{{ key_name }}

  184.     - user: {{ name }}

  185.     - group: {{ user_group }}

  186.     - mode: 600

  187.     - show_diff: False

  188.     - contents_pillar: users:{{ name }}:ssh_keys:{{ _key }}

  189.     - require:

  190.       - user: users_{{ name }}_user

  191.       {% for group in user.get('groups', []) %}

  192.       - group: users_{{ name }}_{{ group }}_group

  193.       {% endfor %}

  194. users_{{ name }}_{{ key_name }}_public_key:

  195.   file.managed:

  196.     - name: {{ home }}/.ssh/{{ key_name }}

  197.     - user: {{ name }}

  198.     - group: {{ user_group }}

  199.     - mode: 644

  200.     - show_diff: False

  201.     - contents_pillar: users:{{ name }}:ssh_keys:{{ _key }}

  202.     - require:

  203.       - user: users_{{ name }}_user

  204.       {% for group in user.get('groups', []) %}

  205.       - group: users_{{ name }}_{{ group }}_group

  206.       {% endfor %}

  207.     {% endfor %}

  208.   {% endif %}

  209. 

  210. 

  211. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  212. users_authorized_keys_{{ name }}:

  213.   file.managed:

  214.     - name: {{ home }}/.ssh/authorized_keys

  215.     - user: {{ name }}

  216.     - group: {{ user_group }}

  217.     - mode: 600

  218. {% if 'ssh_auth_file' in user %}

  219.     - contents: |

  220.         {% for auth in user.ssh_auth_file -%}

  221.         {{ auth }}

  222.         {% endfor -%}

  223. {% else %}

  224.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].items() %}

  225.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  226.         {%- endfor %}

  227. {% endif %}

  228. {% endif %}

  229. 

  230. {% if 'ssh_auth' in user %}

  231. {% for auth in user['ssh_auth'] %}

  232. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  233.   ssh_auth.present:

  234.     - user: {{ name }}

  235.     - name: {{ auth }}

  236.     - require:

  237.         - file: user_keydir_{{ name }}

  238.         - user: users_{{ name }}_user

  239. {% endfor %}

  240. {% endif %}

  241. 

  242. {% if 'ssh_keys_pillar' in user %}

  243. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  244. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  245.   file.managed:

  246.     - name: {{ home }}/.ssh/{{ key_name }}

  247.     - user: {{ name }}

  248.     - group: {{ user_group }}

  249.     - mode: 600

  250.     - show_diff: False

  251.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  252.     - require:

  253.       - user: users_{{ name }}_user

  254.       {% for group in user.get('groups', []) %}

  255.       - group: users_{{ name }}_{{ group }}_group

  256.       {% endfor %}

  257. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  258.   file.managed:

  259.     - name: {{ home }}/.ssh/{{ key_name }}.pub

  260.     - user: {{ name }}

  261.     - group: {{ user_group }}

  262.     - mode: 644

  263.     - show_diff: False

  264.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  265.     - require:

  266.       - user: users_{{ name }}_user

  267.       {% for group in user.get('groups', []) %}

  268.       - group: users_{{ name }}_{{ group }}_group

  269.       {% endfor %}

  270. {% endfor %}

  271. {% endif %}

  272. 

  273. {% if 'ssh_auth_sources' in user %}

  274. {% for pubkey_file in user['ssh_auth_sources'] %}

  275. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  276.   ssh_auth.present:

  277.     - user: {{ name }}

  278.     - source: {{ pubkey_file }}

  279.     - require:

  280.         - file: users_{{ name }}_user

  281.         - user: users_{{ name }}_user

  282. {% endfor %}

  283. {% endif %}

  284. 

  285. {% if 'ssh_auth.absent' in user %}

  286. {% for auth in user['ssh_auth.absent'] %}

  287. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  288.   ssh_auth.absent:

  289.     - user: {{ name }}

  290.     - name: {{ auth }}

  291.     - require:

  292.         - file: users_{{ name }}_user

  293.         - user: users_{{ name }}_user

  294. {% endfor %}

  295. {% endif %}

  296. 

  297. {% if 'ssh_config' in user %}

  298. users_ssh_config_{{ name }}:

  299.   file.managed:

  300.     - name: {{ home }}/.ssh/config

  301.     - user: {{ name }}

  302.     - group: {{ user_group }}

  303.     - mode: 640

  304.     - contents: |

  305.         # Managed by Saltstack

  306.         # Do Not Edit

  307.         {% for label, setting in user.ssh_config.items() %}

  308.         # {{ label }}

  309.         Host {{ setting.get('hostname') }}

  310.           {%- for opts in setting.get('options') %}

  311.           {{ opts }}

  312.           {%- endfor %}

  313.         {% endfor -%}

  314. {% endif %}

  315. 

  316. {% if 'ssh_known_hosts' in user %}

  317. {% for hostname, host in user['ssh_known_hosts'].items() %}

  318. users_ssh_known_hosts_{{ name }}_{{ loop.index0 }}:

  319.   ssh_known_hosts.present:

  320.     - user: {{ name }}

  321.     - name: {{ hostname }}

  322.     {% if 'port' in host %}

  323.     - port: {{ host['port'] }}

  324.     {% endif -%}

  325.     {% if 'fingerprint' in host %}

  326.     - fingerprint: {{ host['fingerprint'] }}

  327.     {% endif -%}

  328.     {% if 'key' in host %}

  329.     - key: {{ host['key'] }}

  330.     {% endif -%}

  331.     {% if 'enc' in host %}

  332.     - enc: {{ host['enc'] }}

  333.     {% endif -%}

  334.     {% if 'hash_hostname' in host %}

  335.     - hash_hostname: {{ host['hash_hostname'] }}

  336.     {% endif -%}

  337. {% endfor %}

  338. {% endif %}

  339. 

  340. {% if 'ssh_known_hosts.absent' in user %}

  341. {% for host in user['ssh_known_hosts.absent'] %}

  342. users_ssh_known_hosts_delete_{{ name }}_{{ loop.index0 }}:

  343.   ssh_known_hosts.absent:

  344.     - user: {{ name }}

  345.     - name: {{ host }}

  346. {% endfor %}

  347. {% endif %}

  348. 

  349. {% if 'sudouser' in user and user['sudouser'] %}

  350. 

  351. users_sudoer-{{ name }}:

  352.   file.managed:

  353.     - replace: False

  354.     - name: {{ users.sudoers_dir }}/{{ name }}

  355.     - user: root

  356.     - group: {{ users.root_group }}

  357.     - mode: '0440'

  358. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  359. #{#%

  360. {% if 'sudo_rules' in user %}

  361. {% for rule in user['sudo_rules'] %}

  362. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  363.   cmd.run:

  364.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  365.     - stateful: True

  366.     - shell: {{ users.visudo_shell }}

  367.     - env:

  368.       # Specify the rule via an env var to avoid shell quoting issues.

  369.       - rule: "{{ name }} {{ rule }}"

  370.     - require_in:

  371.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  372. {% endfor %}

  373. {% endif %}

  374. {% if 'sudo_defaults' in user %}

  375. {% for entry in user['sudo_defaults'] %}

  376. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  377.   cmd.run:

  378.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  379.     - stateful: True

  380.     - shell: {{ users.visudo_shell }}

  381.     - env:

  382.       # Specify the rule via an env var to avoid shell quoting issues.

  383.       - rule: "Defaults:{{ name }} {{ entry }}"

  384.     - require_in:

  385.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  386. {% endfor %}

  387. {% endif %}

  388. #%#}

  389. 

  390. users_{{ users.sudoers_dir }}/{{ name }}:

  391.   file.managed:

  392.     - replace: True

  393.     - name: {{ users.sudoers_dir }}/{{ name }}

  394.     - contents: |

  395.       {%- if 'sudo_defaults' in user %}

  396.       {%- for entry in user['sudo_defaults'] %}

  397.         Defaults:{{ name }} {{ entry }}

  398.       {%- endfor %}

  399.       {%- endif %}

  400.       {%- if 'sudo_rules' in user %}

  401.         ########################################################################

  402.         # File managed by Salt (users-formula).

  403.         # Your changes will be overwritten.

  404.         ########################################################################

  405.         #

  406.       {%- for rule in user['sudo_rules'] %}

  407.         {{ name }} {{ rule }}

  408.       {%- endfor %}

  409.       {%- endif %}

  410.     - require:

  411.       - file: users_sudoer-defaults

  412.       - file: users_sudoer-{{ name }}

  413.   cmd.wait:

  414.     - name: visudo -cf {{ users.sudoers_dir }}/{{ name }} || ( rm -rvf {{ users.sudoers_dir }}/{{ name }}; exit 1 )

  415.     - watch:

  416.       - file: {{ users.sudoers_dir }}/{{ name }}

  417. {% endif %}

  418. {% else %}

  419. users_{{ users.sudoers_dir }}/{{ name }}:

  420.   file.absent:

  421.     - name: {{ users.sudoers_dir }}/{{ name }}

  422. {% endif %}

  423. 

  424. {%- if 'google_auth' in user %}

  425. {%- for svc in user['google_auth'] %}

  426. users_googleauth-{{ svc }}-{{ name }}:

  427.   file.managed:

  428.     - replace: false

  429.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  430.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  431.     - user: root

  432.     - group: {{ users.root_group }}

  433.     - mode: 400

  434.     - require:

  435.       - pkg: users_googleauth-package

  436. {%- endfor %}

  437. {%- endif %}

  438. 

  439. {% if 'gitconfig' in user %}

  440. {% if not salt['cmd.has_exec']('git') %}

  441. skip_{{ name }}_gitconfig_since_git_not_installed:

  442.   test.fail_without_changes:

  443.     - name: "Git configuration for user {{ name }} has been skipped because Git is not installed."

  444. {% else %}

  445. {% for key, value in user['gitconfig'].items() %}

  446. users_{{ name }}_user_gitconfig_{{ loop.index0 }}:

  447.   {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  448.   git.config_set:

  449.   {% else %}

  450.   git.config:

  451.   {% endif %}

  452.     - name: {{ key }}

  453.     - value: "{{ value }}"

  454.     - user: {{ name }}

  455.     {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  456.     - global: True

  457.     {% else %}

  458.     - is_global: True

  459.     {% endif %}

  460. {% endfor %}

  461. {% endif %}

  462. {% endif %}

  463. 

  464. {% endfor %}

  465. 

  466. 

  467. {% for name, user in pillar.get('users', {}).items()

  468.         if user.absent is defined and user.absent %}

  469. users_absent_user_{{ name }}:

  470. {% if 'purge' in user or 'force' in user %}

  471.   user.absent:

  472.     - name: {{ name }}

  473.     {% if 'purge' in user %}

  474.     - purge: {{ user['purge'] }}

  475.     {% endif %}

  476.     {% if 'force' in user %}

  477.     - force: {{ user['force'] }}

  478.     {% endif %}

  479. {% else %}

  480.   user.absent:

  481.     - name: {{ name }}

  482. {% endif -%}

  483. users_{{ users.sudoers_dir }}/{{ name }}:

  484.   file.absent:

  485.     - name: {{ users.sudoers_dir }}/{{ name }}

  486. {% endfor %}

  487. 

  488. {% for user in pillar.get('absent_users', []) %}

  489. users_absent_user_2_{{ user }}:

  490.   user.absent:

  491.     - name: {{ name }}

  492. users_2_{{ users.sudoers_dir }}/{{ user }}:

  493.   file.absent:

  494.     - name: {{ users.sudoers_dir }}/{{ user }}

  495. {% endfor %}

  496. 

  497. {% for group in pillar.get('absent_groups', []) %}

  498. users_absent_group_{{ group }}:

  499.   group.absent:

  500.     - name: {{ group }}

  501. {% endfor %}