salt
/
users-formula
forkeado de ExternalMirrors/users-formula
Seguir 1
Destacar 0
Fork 0
Código Lanzamientos 0 Actividad
Saltstack Official Users Formula
No puede seleccionar más de 25 temas Los temas deben comenzar con una letra o número, pueden incluir guiones ('-') y pueden tener hasta 35 caracteres de largo.
138 Commits
2 Ramas
Árbol: 2f4c088e5d
Ramas Etiquetas
${ item.name }
Crear rama ${ searchTerm }
desde '2f4c088e5d'
${ noResults }
users-formula/users/init.sls

363 líneas
10KB
Original Blame Histórico 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. 

  6. {%- for name, user in pillar.get('users', {}).iteritems() if user.absent is not defined or not user.absent %}

  7. {%- if user == None -%}

  8. {%- set user = {} -%}

  9. {%- endif -%}

  10. {%- if 'sudouser' in user and user['sudouser'] %}

  11. {%- do used_sudo.append(1) %}

  12. {%- endif %}

  13. {%- if 'google_auth' in user %}

  14. {%- do used_googleauth.append(1) %}

  15. {%- endif %}

  16. {%- endfor %}

  17. 

  18. {%- if used_sudo or used_googleauth %}

  19. include:

  20. {%- if used_sudo %}

  21.   - users.sudo

  22. {%- endif %}

  23. {%- if used_googleauth %}

  24.   - users.googleauth

  25. {%- endif %}

  26. {%- endif %}

  27. 

  28. {% for name, user in pillar.get('users', {}).iteritems() if user.absent is not defined or not user.absent %}

  29. {%- if user == None -%}

  30. {%- set user = {} -%}

  31. {%- endif -%}

  32. {%- set home = user.get('home', "/home/%s" % name) -%}

  33. 

  34. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  35. {%- set user_group = user.prime_group.name -%}

  36. {%- else -%}

  37. {%- set user_group = name -%}

  38. {%- endif %}

  39. 

  40. {% for group in user.get('groups', []) %}

  41. users_{{ name }}_{{ group }}_group:

  42.   group:

  43.     - name: {{ group }}

  44.     - present

  45. {% endfor %}

  46. 

  47. users_{{ name }}_user:

  48.   {% if user.get('createhome', True) %}

  49.   file.directory:

  50.     - name: {{ home }}

  51.     - user: {{ name }}

  52.     - group: {{ user_group }}

  53.     - mode: {{ user.get('user_dir_mode', '0750') }}

  54.     - require:

  55.       - user: users_{{ name }}_user

  56.       - group: {{ user_group }}

  57.   {%- endif %}

  58.   group.present:

  59.     - name: {{ user_group }}

  60.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  61.     - gid: {{ user['prime_group']['gid'] }}

  62.     {%- elif 'uid' in user %}

  63.     - gid: {{ user['uid'] }}

  64.     {%- endif %}

  65.   user.present:

  66.     - name: {{ name }}

  67.     - home: {{ home }}

  68.     - shell: {{ user.get('shell', users.get('shell', '/bin/bash')) }}

  69.     {% if 'uid' in user -%}

  70.     - uid: {{ user['uid'] }}

  71.     {% endif -%}

  72.     {% if 'password' in user -%}

  73.     - password: '{{ user['password'] }}'

  74.     {% endif -%}

  75.     {% if user.get('system', False) -%}

  76.     - system: True

  77.     {% endif -%}

  78.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  79.     - gid: {{ user['prime_group']['gid'] }}

  80.     {% else -%}

  81.     - gid_from_name: True

  82.     {% endif -%}

  83.     {% if 'fullname' in user %}

  84.     - fullname: {{ user['fullname'] }}

  85.     {% endif -%}

  86.     {% if not user.get('createhome', True) %}

  87.     - createhome: False

  88.     {% endif %}

  89.     {% if 'expire' in user -%}

  90.     - expire: {{ user['expire'] }}

  91.     {% endif -%}

  92.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  93.     - groups:

  94.       - {{ user_group }}

  95.       {% for group in user.get('groups', []) -%}

  96.       - {{ group }}

  97.       {% endfor %}

  98.     - require:

  99.       - group: {{ user_group }}

  100.       {% for group in user.get('groups', []) -%}

  101.       - group: {{ group }}

  102.       {% endfor %}

  103. 

  104. 

  105.   {% if 'ssh_keys' in user or 'ssh_auth' in user or 'ssh_auth.absent' in user %}

  106. user_keydir_{{ name }}:

  107.   file.directory:

  108.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh

  109.     - user: {{ name }}

  110.     - group: {{ user_group }}

  111.     - makedirs: True

  112.     - mode: 700

  113.     - require:

  114.       - user: {{ name }}

  115.       - group: {{ user_group }}

  116.       {%- for group in user.get('groups', []) %}

  117.       - group: {{ group }}

  118.       {%- endfor %}

  119.   {% endif %}

  120. 

  121.   {% if 'ssh_keys' in user %}

  122.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  123. users_user_{{ name }}_private_key:

  124.   file.managed:

  125.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}

  126.     - user: {{ name }}

  127.     - group: {{ user_group }}

  128.     - mode: 600

  129.     - show_diff: False

  130.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  131.     - require:

  132.       - user: users_{{ name }}_user

  133.       {% for group in user.get('groups', []) %}

  134.       - group: users_{{ name }}_{{ group }}_group

  135.       {% endfor %}

  136. users_user_{{ name }}_public_key:

  137.   file.managed:

  138.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}.pub

  139.     - user: {{ name }}

  140.     - group: {{ user_group }}

  141.     - mode: 644

  142.     - show_diff: False

  143.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  144.     - require:

  145.       - user: users_{{ name }}_user

  146.       {% for group in user.get('groups', []) %}

  147.       - group: users_{{ name }}_{{ group }}_group

  148.       {% endfor %}

  149.   {% endif %}

  150. 

  151. {% if 'ssh_auth_file' in user %}

  152. users_authorized_keys_{{ name }}:

  153.   file.managed:

  154.     - name: {{ home }}/.ssh/authorized_keys

  155.     - user: {{ name }}

  156.     - group: {{ name }}

  157.     - mode: 600

  158.     - contents: |

  159.         {% for auth in user.ssh_auth_file -%}

  160.         {{ auth }}

  161.         {% endfor -%}

  162. {% endif %}

  163. 

  164. {% if 'ssh_auth' in user %}

  165. {% for auth in user['ssh_auth'] %}

  166. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  167.   ssh_auth.present:

  168.     - user: {{ name }}

  169.     - name: {{ auth }}

  170.     - require:

  171.         - file: users_{{ name }}_user

  172.         - user: users_{{ name }}_user

  173. {% endfor %}

  174. {% endif %}

  175. 

  176. {% if 'ssh_keys_pillar' in user %}

  177. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  178. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  179.   file.managed:

  180.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}

  181.     - user: {{ name }}

  182.     - group: {{ user_group }}

  183.     - mode: 600

  184.     - show_diff: False

  185.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  186.     - require:

  187.       - user: users_{{ name }}_user

  188.       {% for group in user.get('groups', []) %}

  189.       - group: users_{{ name }}_{{ group }}_group

  190.       {% endfor %}

  191. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  192.   file.managed:

  193.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}.pub

  194.     - user: {{ name }}

  195.     - group: {{ user_group }}

  196.     - mode: 644

  197.     - show_diff: False

  198.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  199.     - require:

  200.       - user: users_{{ name }}_user

  201.       {% for group in user.get('groups', []) %}

  202.       - group: users_{{ name }}_{{ group }}_group

  203.       {% endfor %}

  204. {% endfor %}

  205. {% endif %}

  206. 

  207. {% if 'ssh_auth_sources' in user %}

  208. {% for pubkey_file in user['ssh_auth_sources'] %}

  209. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  210.   ssh_auth.present:

  211.     - user: {{ name }}

  212.     - source: {{ pubkey_file }}

  213.     - require:

  214.         - file: users_{{ name }}_user

  215.         - user: users_{{ name }}_user

  216. {% endfor %}

  217. {% endif %}

  218. 

  219. {% if 'ssh_auth.absent' in user %}

  220. {% for auth in user['ssh_auth.absent'] %}

  221. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  222.   ssh_auth.absent:

  223.     - user: {{ name }}

  224.     - name: {{ auth }}

  225.     - require:

  226.         - file: users_{{ name }}_user

  227.         - user: users_{{ name }}_user

  228. {% endfor %}

  229. {% endif %}

  230. 

  231. {% if 'ssh_config' in user %}

  232. users_ssh_config_{{ name }}:

  233.   file.managed:

  234.     - name: {{ home }}/.ssh/config

  235.     - user: {{ name }}

  236.     - group: {{ user_group }}

  237.     - mode: 640

  238.     - contents: |

  239.         # Managed by Saltstack

  240.         # Do Not Edit

  241.         {% for label, setting in user.ssh_config.items() %}

  242.         # {{ label }}

  243.         Host {{ setting.get('hostname') }}

  244.           {%- for opts in setting.get('options') %}

  245.           {{ opts }}

  246.           {%- endfor %}

  247.         {% endfor -%}

  248. {% endif %}

  249. 

  250. {% if 'sudouser' in user and user['sudouser'] %}

  251. 

  252. users_sudoer-{{ name }}:

  253.   file.managed:

  254.     - name: {{ users.sudoers_dir }}/{{ name }}

  255.     - user: root

  256.     - group: {{ users.root_group }}

  257.     - mode: '0440'

  258. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  259. {% if 'sudo_rules' in user %}

  260. {% for rule in user['sudo_rules'] %}

  261. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  262.   cmd.run:

  263.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  264.     - stateful: True

  265.     - shell: {{ users.visudo_shell }}

  266.     - env:

  267.       # Specify the rule via an env var to avoid shell quoting issues.

  268.       - rule: "{{ name }} {{ rule }}"

  269.     - require_in:

  270.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  271. {% endfor %}

  272. {% endif %}

  273. {% if 'sudo_defaults' in user %}

  274. {% for entry in user['sudo_defaults'] %}

  275. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  276.   cmd.run:

  277.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  278.     - stateful: True

  279.     - shell: {{ users.visudo_shell }}

  280.     - env:

  281.       # Specify the rule via an env var to avoid shell quoting issues.

  282.       - rule: "Defaults:{{ name }} {{ entry }}"

  283.     - require_in:

  284.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  285. {% endfor %}

  286. {% endif %}

  287. 

  288. users_{{ users.sudoers_dir }}/{{ name }}:

  289.   file.managed:

  290.     - name: {{ users.sudoers_dir }}/{{ name }}

  291.     - contents: |

  292.       {%- if 'sudo_defaults' in user %}

  293.       {%- for entry in user['sudo_defaults'] %}

  294.         Defaults:{{ name }} {{ entry }}

  295.       {%- endfor %}

  296.       {%- endif %}

  297.       {%- if 'sudo_rules' in user %}

  298.       {%- for rule in user['sudo_rules'] %}

  299.         {{ name }} {{ rule }}

  300.       {%- endfor %}

  301.       {%- endif %}

  302.     - require:

  303.       - file: users_sudoer-defaults

  304.       - file: users_sudoer-{{ name }}

  305. {% endif %}

  306. {% else %}

  307. users_{{ users.sudoers_dir }}/{{ name }}:

  308.   file.absent:

  309.     - name: {{ users.sudoers_dir }}/{{ name }}

  310. {% endif %}

  311. 

  312. {%- if 'google_auth' in user %}

  313. {%- for svc in user['google_auth'] %}

  314. users_googleauth-{{ svc }}-{{ name }}:

  315.   file.managed:

  316.     - replace: false

  317.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  318.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  319.     - user: root

  320.     - group: {{ users.root_group }}

  321.     - mode: 400

  322.     - require:

  323.       - pkg: users_googleauth-package

  324. {%- endfor %}

  325. {%- endif %}

  326. 

  327. {% endfor %}

  328. 

  329. 

  330. {% for name, user in pillar.get('users', {}).iteritems() if user.absent is defined and user.absent %}

  331. users_absent_user_{{ name }}:

  332. {% if 'purge' in user or 'force' in user %}

  333.   user.absent:

  334.     - name: {{ name }}

  335.     {% if 'purge' in user %}

  336.     - purge: {{ user['purge'] }}

  337.     {% endif %}

  338.     {% if 'force' in user %}

  339.     - force: {{ user['force'] }}

  340.     {% endif %}

  341. {% else %}

  342.   user.absent:

  343.     - name: {{ name }}

  344. {% endif -%}

  345. users_{{ users.sudoers_dir }}/{{ name }}:

  346.   file.absent:

  347.     - name: {{ users.sudoers_dir }}/{{ name }}

  348. {% endfor %}

  349. 

  350. {% for user in pillar.get('absent_users', []) %}

  351. users_absent_user_2_{{ user }}:

  352.   user.absent

  353. users_2_{{ users.sudoers_dir }}/{{ user }}:

  354.   file.absent:

  355.     - name: {{ users.sudoers_dir }}/{{ user }}

  356. {% endfor %}

  357. 

  358. {% for group in pillar.get('absent_groups', []) %}

  359. users_absent_group_{{ group }}:

  360.   group.absent:

  361.     - name: {{ group }}

  362. {% endfor %}