ExternalMirrors
/
users-formula
mirror of https://github.com/saltstack-formulas/users-formula
Watch 1
Star 0
Fork 1
Code Issues 0 Releases 13 Wiki Activity
Saltstack Official Users Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
158 Commits
3 Branches
Tree: cdb862e968
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'cdb862e968'
${ noResults }
users-formula/users/init.sls

391 lines
11KB
Raw Blame History 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. 

  7. {%- for name, user in pillar.get('users', {}).items()

  8.         if user.absent is not defined or not user.absent %}

  9. {%- if user == None -%}

  10. {%- set user = {} -%}

  11. {%- endif -%}

  12. {%- if 'sudouser' in user and user['sudouser'] %}

  13. {%- do used_sudo.append(1) %}

  14. {%- endif %}

  15. {%- if 'google_auth' in user %}

  16. {%- do used_googleauth.append(1) %}

  17. {%- endif %}

  18. {%- if pillar.get('users:' + name + ':user_files:enabled', False) %}

  19. {%- do used_user_files.append(1) %}

  20. {%- endif %}

  21. {%- endfor %}

  22. 

  23. {%- if used_sudo or used_googleauth or used_user_files %}

  24. include:

  25. {%- if used_sudo %}

  26.   - users.sudo

  27. {%- endif %}

  28. {%- if used_googleauth %}

  29.   - users.googleauth

  30. {%- endif %}

  31. {%- if used_user_files %}

  32.   - users.user_files

  33. {%- endif %}

  34. {%- endif %}

  35. 

  36. {% for name, user in pillar.get('users', {}).items()

  37.         if user.absent is not defined or not user.absent %}

  38. {%- if user == None -%}

  39. {%- set user = {} -%}

  40. {%- endif -%}

  41. {%- set home = user.get('home', "/home/%s" % name) -%}

  42. 

  43. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  44. {%- set user_group = user.prime_group.name -%}

  45. {%- else -%}

  46. {%- set user_group = name -%}

  47. {%- endif %}

  48. 

  49. {% for group in user.get('groups', []) %}

  50. users_{{ name }}_{{ group }}_group:

  51.   group:

  52.     - name: {{ group }}

  53.     - present

  54. {% endfor %}

  55. 

  56. users_{{ name }}_user:

  57.   {% if user.get('createhome', True) %}

  58.   file.directory:

  59.     - name: {{ home }}

  60.     - user: {{ name }}

  61.     - group: {{ user_group }}

  62.     - mode: {{ user.get('user_dir_mode', '0750') }}

  63.     - require:

  64.       - user: users_{{ name }}_user

  65.       - group: {{ user_group }}

  66.   {%- endif %}

  67.   group.present:

  68.     - name: {{ user_group }}

  69.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  70.     - gid: {{ user['prime_group']['gid'] }}

  71.     {%- elif 'uid' in user %}

  72.     - gid: {{ user['uid'] }}

  73.     {%- endif %}

  74.   user.present:

  75.     - name: {{ name }}

  76.     - home: {{ home }}

  77.     - shell: {{ user.get('shell', users.get('shell', '/bin/bash')) }}

  78.     {% if 'uid' in user -%}

  79.     - uid: {{ user['uid'] }}

  80.     {% endif -%}

  81.     {% if 'password' in user -%}

  82.     - password: '{{ user['password'] }}'

  83.     {% endif -%}

  84.     {% if 'enforce_password' in user -%}

  85.     - enforce_password: {{ user['enforce_password'] }}

  86.     {% endif -%}

  87.     {% if user.get('system', False) -%}

  88.     - system: True

  89.     {% endif -%}

  90.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  91.     - gid: {{ user['prime_group']['gid'] }}

  92.     {% else -%}

  93.     - gid_from_name: True

  94.     {% endif -%}

  95.     {% if 'fullname' in user %}

  96.     - fullname: {{ user['fullname'] }}

  97.     {% endif -%}

  98.     {% if not user.get('createhome', True) %}

  99.     - createhome: False

  100.     {% endif %}

  101.     {% if 'expire' in user -%}

  102.     - expire: {{ user['expire'] }}

  103.     {% endif -%}

  104.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  105.     - groups:

  106.       - {{ user_group }}

  107.       {% for group in user.get('groups', []) -%}

  108.       - {{ group }}

  109.       {% endfor %}

  110.     - require:

  111.       - group: {{ user_group }}

  112.       {% for group in user.get('groups', []) -%}

  113.       - group: {{ group }}

  114.       {% endfor %}

  115. 

  116. 

  117.   {% if 'ssh_keys' in user or

  118.       'ssh_auth' in user or

  119.       'ssh_auth_file' in user or

  120.       'ssh_auth.absent' in user or

  121.       'ssh_config' in user %}

  122. user_keydir_{{ name }}:

  123.   file.directory:

  124.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh

  125.     - user: {{ name }}

  126.     - group: {{ user_group }}

  127.     - makedirs: True

  128.     - mode: 700

  129.     - require:

  130.       - user: {{ name }}

  131.       - group: {{ user_group }}

  132.       {%- for group in user.get('groups', []) %}

  133.       - group: {{ group }}

  134.       {%- endfor %}

  135.   {% endif %}

  136. 

  137.   {% if 'ssh_keys' in user %}

  138.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  139. users_user_{{ name }}_private_key:

  140.   file.managed:

  141.     - name: {{ user.get('home',

  142.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}

  143.     - user: {{ name }}

  144.     - group: {{ user_group }}

  145.     - mode: 600

  146.     - show_diff: False

  147.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  148.     - require:

  149.       - user: users_{{ name }}_user

  150.       {% for group in user.get('groups', []) %}

  151.       - group: users_{{ name }}_{{ group }}_group

  152.       {% endfor %}

  153. users_user_{{ name }}_public_key:

  154.   file.managed:

  155.     - name: {{ user.get('home',

  156.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}.pub

  157.     - user: {{ name }}

  158.     - group: {{ user_group }}

  159.     - mode: 644

  160.     - show_diff: False

  161.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  162.     - require:

  163.       - user: users_{{ name }}_user

  164.       {% for group in user.get('groups', []) %}

  165.       - group: users_{{ name }}_{{ group }}_group

  166.       {% endfor %}

  167.   {% endif %}

  168. 

  169. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  170. users_authorized_keys_{{ name }}:

  171.   file.managed:

  172.     - name: {{ home }}/.ssh/authorized_keys

  173.     - user: {{ name }}

  174.     - group: {{ name }}

  175.     - mode: 600

  176. {% if 'ssh_auth_file' in user %}

  177.     - contents: |

  178.         {% for auth in user.ssh_auth_file -%}

  179.         {{ auth }}

  180.         {% endfor -%}

  181. {% else %}

  182.     - contents: |

  183.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].iteritems() %}

  184.         {{ salt['pillar.get'](pillar_name + ':' + key_name + ':pubkey', '') }}

  185.         {%- endfor %}

  186. {% endif %}

  187. {% endif %}

  188. 

  189. {% if 'ssh_auth' in user %}

  190. {% for auth in user['ssh_auth'] %}

  191. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  192.   ssh_auth.present:

  193.     - user: {{ name }}

  194.     - name: {{ auth }}

  195.     - require:

  196.         - file: users_{{ name }}_user

  197.         - user: users_{{ name }}_user

  198. {% endfor %}

  199. {% endif %}

  200. 

  201. {% if 'ssh_keys_pillar' in user %}

  202. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  203. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  204.   file.managed:

  205.     - name: {{ user.get('home',

  206.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}

  207.     - user: {{ name }}

  208.     - group: {{ user_group }}

  209.     - mode: 600

  210.     - show_diff: False

  211.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  212.     - require:

  213.       - user: users_{{ name }}_user

  214.       {% for group in user.get('groups', []) %}

  215.       - group: users_{{ name }}_{{ group }}_group

  216.       {% endfor %}

  217. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  218.   file.managed:

  219.     - name: {{ user.get('home',

  220.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}.pub

  221.     - user: {{ name }}

  222.     - group: {{ user_group }}

  223.     - mode: 644

  224.     - show_diff: False

  225.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  226.     - require:

  227.       - user: users_{{ name }}_user

  228.       {% for group in user.get('groups', []) %}

  229.       - group: users_{{ name }}_{{ group }}_group

  230.       {% endfor %}

  231. {% endfor %}

  232. {% endif %}

  233. 

  234. {% if 'ssh_auth_sources' in user %}

  235. {% for pubkey_file in user['ssh_auth_sources'] %}

  236. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  237.   ssh_auth.present:

  238.     - user: {{ name }}

  239.     - source: {{ pubkey_file }}

  240.     - require:

  241.         - file: users_{{ name }}_user

  242.         - user: users_{{ name }}_user

  243. {% endfor %}

  244. {% endif %}

  245. 

  246. {% if 'ssh_auth.absent' in user %}

  247. {% for auth in user['ssh_auth.absent'] %}

  248. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  249.   ssh_auth.absent:

  250.     - user: {{ name }}

  251.     - name: {{ auth }}

  252.     - require:

  253.         - file: users_{{ name }}_user

  254.         - user: users_{{ name }}_user

  255. {% endfor %}

  256. {% endif %}

  257. 

  258. {% if 'ssh_config' in user %}

  259. users_ssh_config_{{ name }}:

  260.   file.managed:

  261.     - name: {{ home }}/.ssh/config

  262.     - user: {{ name }}

  263.     - group: {{ user_group }}

  264.     - mode: 640

  265.     - contents: |

  266.         # Managed by Saltstack

  267.         # Do Not Edit

  268.         {% for label, setting in user.ssh_config.items() %}

  269.         # {{ label }}

  270.         Host {{ setting.get('hostname') }}

  271.           {%- for opts in setting.get('options') %}

  272.           {{ opts }}

  273.           {%- endfor %}

  274.         {% endfor -%}

  275. {% endif %}

  276. 

  277. {% if 'sudouser' in user and user['sudouser'] %}

  278. 

  279. users_sudoer-{{ name }}:

  280.   file.managed:

  281.     - name: {{ users.sudoers_dir }}/{{ name }}

  282.     - user: root

  283.     - group: {{ users.root_group }}

  284.     - mode: '0440'

  285. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  286. {% if 'sudo_rules' in user %}

  287. {% for rule in user['sudo_rules'] %}

  288. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  289.   cmd.run:

  290.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  291.     - stateful: True

  292.     - shell: {{ users.visudo_shell }}

  293.     - env:

  294.       # Specify the rule via an env var to avoid shell quoting issues.

  295.       - rule: "{{ name }} {{ rule }}"

  296.     - require_in:

  297.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  298. {% endfor %}

  299. {% endif %}

  300. {% if 'sudo_defaults' in user %}

  301. {% for entry in user['sudo_defaults'] %}

  302. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  303.   cmd.run:

  304.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  305.     - stateful: True

  306.     - shell: {{ users.visudo_shell }}

  307.     - env:

  308.       # Specify the rule via an env var to avoid shell quoting issues.

  309.       - rule: "Defaults:{{ name }} {{ entry }}"

  310.     - require_in:

  311.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  312. {% endfor %}

  313. {% endif %}

  314. 

  315. users_{{ users.sudoers_dir }}/{{ name }}:

  316.   file.managed:

  317.     - name: {{ users.sudoers_dir }}/{{ name }}

  318.     - contents: |

  319.       {%- if 'sudo_defaults' in user %}

  320.       {%- for entry in user['sudo_defaults'] %}

  321.         Defaults:{{ name }} {{ entry }}

  322.       {%- endfor %}

  323.       {%- endif %}

  324.       {%- if 'sudo_rules' in user %}

  325.       {%- for rule in user['sudo_rules'] %}

  326.         {{ name }} {{ rule }}

  327.       {%- endfor %}

  328.       {%- endif %}

  329.     - require:

  330.       - file: users_sudoer-defaults

  331.       - file: users_sudoer-{{ name }}

  332. {% endif %}

  333. {% else %}

  334. users_{{ users.sudoers_dir }}/{{ name }}:

  335.   file.absent:

  336.     - name: {{ users.sudoers_dir }}/{{ name }}

  337. {% endif %}

  338. 

  339. {%- if 'google_auth' in user %}

  340. {%- for svc in user['google_auth'] %}

  341. users_googleauth-{{ svc }}-{{ name }}:

  342.   file.managed:

  343.     - replace: false

  344.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  345.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  346.     - user: root

  347.     - group: {{ users.root_group }}

  348.     - mode: 400

  349.     - require:

  350.       - pkg: users_googleauth-package

  351. {%- endfor %}

  352. {%- endif %}

  353. 

  354. {% endfor %}

  355. 

  356. 

  357. {% for name, user in pillar.get('users', {}).items()

  358.         if user.absent is defined and user.absent %}

  359. users_absent_user_{{ name }}:

  360. {% if 'purge' in user or 'force' in user %}

  361.   user.absent:

  362.     - name: {{ name }}

  363.     {% if 'purge' in user %}

  364.     - purge: {{ user['purge'] }}

  365.     {% endif %}

  366.     {% if 'force' in user %}

  367.     - force: {{ user['force'] }}

  368.     {% endif %}

  369. {% else %}

  370.   user.absent:

  371.     - name: {{ name }}

  372. {% endif -%}

  373. users_{{ users.sudoers_dir }}/{{ name }}:

  374.   file.absent:

  375.     - name: {{ users.sudoers_dir }}/{{ name }}

  376. {% endfor %}

  377. 

  378. {% for user in pillar.get('absent_users', []) %}

  379. users_absent_user_2_{{ user }}:

  380.   user.absent

  381. users_2_{{ users.sudoers_dir }}/{{ user }}:

  382.   file.absent:

  383.     - name: {{ users.sudoers_dir }}/{{ user }}

  384. {% endfor %}

  385. 

  386. {% for group in pillar.get('absent_groups', []) %}

  387. users_absent_group_{{ group }}:

  388.   group.absent:

  389.     - name: {{ group }}

  390. {% endfor %}