salt
/
users-formula
forked from ExternalMirrors/users-formula
Watch 1
Star 0
Fork 0
Code Releases 0 Activity
Saltstack Official Users Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
172 Commits
2 Branches
Tree: 441d3cb635
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '441d3cb635'
${ noResults }
users-formula/users/init.sls

461 lines
13KB
Raw Blame History 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. 

  7. {%- for name, user in pillar.get('users', {}).items()

  8.         if user.absent is not defined or not user.absent %}

  9. {%- if user == None -%}

  10. {%- set user = {} -%}

  11. {%- endif -%}

  12. {%- if 'sudouser' in user and user['sudouser'] %}

  13. {%- do used_sudo.append(1) %}

  14. {%- endif %}

  15. {%- if 'google_auth' in user %}

  16. {%- do used_googleauth.append(1) %}

  17. {%- endif %}

  18. {%- if salt['pillar.get']('users:' ~ name ~ ':user_files:enabled', False) %}

  19. {%- do used_user_files.append(1) %}

  20. {%- endif %}

  21. {%- endfor %}

  22. 

  23. {%- if used_sudo or used_googleauth or used_user_files %}

  24. include:

  25. {%- if used_sudo %}

  26.   - users.sudo

  27. {%- endif %}

  28. {%- if used_googleauth %}

  29.   - users.googleauth

  30. {%- endif %}

  31. {%- if used_user_files %}

  32.   - users.user_files

  33. {%- endif %}

  34. {%- endif %}

  35. 

  36. {% for name, user in pillar.get('users', {}).items()

  37.         if user.absent is not defined or not user.absent %}

  38. {%- if user == None -%}

  39. {%- set user = {} -%}

  40. {%- endif -%}

  41. {%- set home = user.get('home', "/home/%s" % name) -%}

  42. 

  43. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  44. {%- set user_group = user.prime_group.name -%}

  45. {%- else -%}

  46. {%- set user_group = name -%}

  47. {%- endif %}

  48. 

  49. {% for group in user.get('groups', []) %}

  50. users_{{ name }}_{{ group }}_group:

  51.   group:

  52.     - name: {{ group }}

  53.     - present

  54. {% endfor %}

  55. 

  56. users_{{ name }}_user:

  57.   {% if user.get('createhome', True) %}

  58.   file.directory:

  59.     - name: {{ home }}

  60.     - user: {{ name }}

  61.     - group: {{ user_group }}

  62.     - mode: {{ user.get('user_dir_mode', '0750') }}

  63.     - require:

  64.       - user: users_{{ name }}_user

  65.       - group: {{ user_group }}

  66.   {%- endif %}

  67.   group.present:

  68.     - name: {{ user_group }}

  69.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  70.     - gid: {{ user['prime_group']['gid'] }}

  71.     {%- elif 'uid' in user %}

  72.     - gid: {{ user['uid'] }}

  73.     {%- endif %}

  74.   user.present:

  75.     - name: {{ name }}

  76.     - home: {{ home }}

  77.     - shell: {{ user.get('shell', users.get('shell', '/bin/bash')) }}

  78.     {% if 'uid' in user -%}

  79.     - uid: {{ user['uid'] }}

  80.     {% endif -%}

  81.     {% if 'password' in user -%}

  82.     - password: '{{ user['password'] }}'

  83.     {% endif -%}

  84.     {% if 'empty_password' in user -%}

  85.     - empty_password: {{ user['empty_password'] }}

  86.     {% endif -%}

  87.     {% if 'enforce_password' in user -%}

  88.     - enforce_password: {{ user['enforce_password'] }}

  89.     {% endif -%}

  90.     {% if user.get('system', False) -%}

  91.     - system: True

  92.     {% endif -%}

  93.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  94.     - gid: {{ user['prime_group']['gid'] }}

  95.     {% else -%}

  96.     - gid_from_name: True

  97.     {% endif -%}

  98.     {% if 'fullname' in user %}

  99.     - fullname: {{ user['fullname'] }}

  100.     {% endif -%}

  101.     {% if 'roomnumber' in user %}

  102.     - roomnumber: {{ user['roomnumber'] }}

  103.     {% endif %}

  104.     {% if 'workphone' in user %}

  105.     - workphone: {{ user['workphone'] }}

  106.     {% endif %}

  107.     {% if 'homephone' in user %}

  108.     - homephone: {{ user['workphone'] }}

  109.     {% endif %}

  110.     {% if not user.get('createhome', True) %}

  111.     - createhome: False

  112.     {% endif %}

  113.     {% if 'expire' in user -%}

  114.     - expire: {{ user['expire'] }}

  115.     {% endif -%}

  116.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  117.     - groups:

  118.       - {{ user_group }}

  119.       {% for group in user.get('groups', []) -%}

  120.       - {{ group }}

  121.       {% endfor %}

  122.     - require:

  123.       - group: {{ user_group }}

  124.       {% for group in user.get('groups', []) -%}

  125.       - group: {{ group }}

  126.       {% endfor %}

  127. 

  128. 

  129.   {% if 'ssh_keys' in user or

  130.       'ssh_auth' in user or

  131.       'ssh_auth_file' in user or

  132.       'ssh_auth.absent' in user or

  133.       'ssh_config' in user %}

  134. user_keydir_{{ name }}:

  135.   file.directory:

  136.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh

  137.     - user: {{ name }}

  138.     - group: {{ user_group }}

  139.     - makedirs: True

  140.     - mode: 700

  141.     - require:

  142.       - user: {{ name }}

  143.       - group: {{ user_group }}

  144.       {%- for group in user.get('groups', []) %}

  145.       - group: {{ group }}

  146.       {%- endfor %}

  147.   {% endif %}

  148. 

  149.   {% if 'ssh_keys' in user %}

  150.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  151. users_user_{{ name }}_private_key:

  152.   file.managed:

  153.     - name: {{ user.get('home',

  154.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}

  155.     - user: {{ name }}

  156.     - group: {{ user_group }}

  157.     - mode: 600

  158.     - show_diff: False

  159.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  160.     - require:

  161.       - user: users_{{ name }}_user

  162.       {% for group in user.get('groups', []) %}

  163.       - group: users_{{ name }}_{{ group }}_group

  164.       {% endfor %}

  165. users_user_{{ name }}_public_key:

  166.   file.managed:

  167.     - name: {{ user.get('home',

  168.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}.pub

  169.     - user: {{ name }}

  170.     - group: {{ user_group }}

  171.     - mode: 644

  172.     - show_diff: False

  173.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  174.     - require:

  175.       - user: users_{{ name }}_user

  176.       {% for group in user.get('groups', []) %}

  177.       - group: users_{{ name }}_{{ group }}_group

  178.       {% endfor %}

  179.   {% endif %}

  180. 

  181. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  182. users_authorized_keys_{{ name }}:

  183.   file.managed:

  184.     - name: {{ home }}/.ssh/authorized_keys

  185.     - user: {{ name }}

  186.     - group: {{ name }}

  187.     - mode: 600

  188. {% if 'ssh_auth_file' in user %}

  189.     - contents: |

  190.         {% for auth in user.ssh_auth_file -%}

  191.         {{ auth }}

  192.         {% endfor -%}

  193. {% else %}

  194.     - contents: |

  195.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].iteritems() %}

  196.         {{ salt['pillar.get'](pillar_name + ':' + key_name + ':pubkey', '') }}

  197.         {%- endfor %}

  198. {% endif %}

  199. {% endif %}

  200. 

  201. {% if 'ssh_auth' in user %}

  202. {% for auth in user['ssh_auth'] %}

  203. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  204.   ssh_auth.present:

  205.     - user: {{ name }}

  206.     - name: {{ auth }}

  207.     - require:

  208.         - file: users_{{ name }}_user

  209.         - user: users_{{ name }}_user

  210. {% endfor %}

  211. {% endif %}

  212. 

  213. {% if 'ssh_keys_pillar' in user %}

  214. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  215. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  216.   file.managed:

  217.     - name: {{ user.get('home',

  218.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}

  219.     - user: {{ name }}

  220.     - group: {{ user_group }}

  221.     - mode: 600

  222.     - show_diff: False

  223.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  224.     - require:

  225.       - user: users_{{ name }}_user

  226.       {% for group in user.get('groups', []) %}

  227.       - group: users_{{ name }}_{{ group }}_group

  228.       {% endfor %}

  229. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  230.   file.managed:

  231.     - name: {{ user.get('home',

  232.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}.pub

  233.     - user: {{ name }}

  234.     - group: {{ user_group }}

  235.     - mode: 644

  236.     - show_diff: False

  237.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  238.     - require:

  239.       - user: users_{{ name }}_user

  240.       {% for group in user.get('groups', []) %}

  241.       - group: users_{{ name }}_{{ group }}_group

  242.       {% endfor %}

  243. {% endfor %}

  244. {% endif %}

  245. 

  246. {% if 'ssh_auth_sources' in user %}

  247. {% for pubkey_file in user['ssh_auth_sources'] %}

  248. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  249.   ssh_auth.present:

  250.     - user: {{ name }}

  251.     - source: {{ pubkey_file }}

  252.     - require:

  253.         - file: users_{{ name }}_user

  254.         - user: users_{{ name }}_user

  255. {% endfor %}

  256. {% endif %}

  257. 

  258. {% if 'ssh_auth.absent' in user %}

  259. {% for auth in user['ssh_auth.absent'] %}

  260. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  261.   ssh_auth.absent:

  262.     - user: {{ name }}

  263.     - name: {{ auth }}

  264.     - require:

  265.         - file: users_{{ name }}_user

  266.         - user: users_{{ name }}_user

  267. {% endfor %}

  268. {% endif %}

  269. 

  270. {% if 'ssh_config' in user %}

  271. users_ssh_config_{{ name }}:

  272.   file.managed:

  273.     - name: {{ home }}/.ssh/config

  274.     - user: {{ name }}

  275.     - group: {{ user_group }}

  276.     - mode: 640

  277.     - contents: |

  278.         # Managed by Saltstack

  279.         # Do Not Edit

  280.         {% for label, setting in user.ssh_config.items() %}

  281.         # {{ label }}

  282.         Host {{ setting.get('hostname') }}

  283.           {%- for opts in setting.get('options') %}

  284.           {{ opts }}

  285.           {%- endfor %}

  286.         {% endfor -%}

  287. {% endif %}

  288. 

  289. {% if 'ssh_known_hosts' in user %}

  290. {% for hostname, host in user['ssh_known_hosts'].items() %}

  291. users_ssh_known_hosts_{{ name }}_{{ loop.index0 }}:

  292.   ssh_known_hosts.present:

  293.     - user: {{ name }}

  294.     - name: {{ hostname }}

  295.     {% if 'port' in host %}

  296.     - port: {{ host['port'] }}

  297.     {% endif -%}

  298.     {% if 'fingerprint' in host %}

  299.     - fingerprint: {{ host['fingerprint'] }}

  300.     {% endif -%}

  301.     {% if 'key' in host %}

  302.     - key: {{ host['key'] }}

  303.     {% endif -%}

  304.     {% if 'enc' in host %}

  305.     - enc: {{ host['enc'] }}

  306.     {% endif -%}

  307.     {% if 'hash_hostname' in host %}

  308.     - hash_hostname: {{ host['hash_hostname'] }}

  309.     {% endif -%}

  310. {% endfor %}

  311. {% endif %}

  312. 

  313. {% if 'ssh_known_hosts.absent' in user %}

  314. {% for host in user['ssh_known_hosts.absent'] %}

  315. users_ssh_known_hosts_delete_{{ name }}_{{ loop.index0 }}:

  316.   ssh_known_hosts.absent:

  317.     - user: {{ name }}

  318.     - name: {{ host }}

  319. {% endfor %}

  320. {% endif %}

  321. 

  322. {% if 'sudouser' in user and user['sudouser'] %}

  323. 

  324. users_sudoer-{{ name }}:

  325.   file.managed:

  326.     - name: {{ users.sudoers_dir }}/{{ name }}

  327.     - user: root

  328.     - group: {{ users.root_group }}

  329.     - mode: '0440'

  330. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  331. #{#%

  332. {% if 'sudo_rules' in user %}

  333. {% for rule in user['sudo_rules'] %}

  334. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  335.   cmd.run:

  336.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  337.     - stateful: True

  338.     - shell: {{ users.visudo_shell }}

  339.     - env:

  340.       # Specify the rule via an env var to avoid shell quoting issues.

  341.       - rule: "{{ name }} {{ rule }}"

  342.     - require_in:

  343.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  344. {% endfor %}

  345. {% endif %}

  346. {% if 'sudo_defaults' in user %}

  347. {% for entry in user['sudo_defaults'] %}

  348. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  349.   cmd.run:

  350.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  351.     - stateful: True

  352.     - shell: {{ users.visudo_shell }}

  353.     - env:

  354.       # Specify the rule via an env var to avoid shell quoting issues.

  355.       - rule: "Defaults:{{ name }} {{ entry }}"

  356.     - require_in:

  357.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  358. {% endfor %}

  359. {% endif %}

  360. #%#}

  361. 

  362. users_{{ users.sudoers_dir }}/{{ name }}:

  363.   file.managed:

  364.     - name: {{ users.sudoers_dir }}/{{ name }}

  365.     - contents: |

  366.       {%- if 'sudo_defaults' in user %}

  367.       {%- for entry in user['sudo_defaults'] %}

  368.         Defaults:{{ name }} {{ entry }}

  369.       {%- endfor %}

  370.       {%- endif %}

  371.       {%- if 'sudo_rules' in user %}

  372.       {%- for rule in user['sudo_rules'] %}

  373.         {{ name }} {{ rule }}

  374.       {%- endfor %}

  375.       {%- endif %}

  376.     - require:

  377.       - file: users_sudoer-defaults

  378.       - file: users_sudoer-{{ name }}

  379.   cmd.wait:                                                                           

  380.     - name: visudo -cf {{ users.sudoers_dir }}/{{ name }} || ( rm -rvf {{ users.sudoers_dir }}/{{ name }}; exit 1 )

  381.     - watch:                                                                         

  382.       - file: {{ users.sudoers_dir }}/{{ name }}   

  383. {% endif %}

  384. {% else %}

  385. users_{{ users.sudoers_dir }}/{{ name }}:

  386.   file.absent:

  387.     - name: {{ users.sudoers_dir }}/{{ name }}

  388. {% endif %}

  389. 

  390. {%- if 'google_auth' in user %}

  391. {%- for svc in user['google_auth'] %}

  392. users_googleauth-{{ svc }}-{{ name }}:

  393.   file.managed:

  394.     - replace: false

  395.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  396.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  397.     - user: root

  398.     - group: {{ users.root_group }}

  399.     - mode: 400

  400.     - require:

  401.       - pkg: users_googleauth-package

  402. {%- endfor %}

  403. {%- endif %}

  404. 

  405. {% if 'gitconfig' in user %}

  406. {% for key, value in user['gitconfig'].items() %}

  407. users_{{ name }}_user_gitconfig_{{ loop.index0 }}:

  408.   {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  409.   git.config_set:

  410.   {% else %}

  411.   git.config:

  412.   {% endif %}

  413.     - name: {{ key }}

  414.     - value: "{{ value }}"

  415.     - user: {{ name }}

  416.     {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  417.     - global: True

  418.     {% else %}

  419.     - is_global: True

  420.     {% endif %}

  421. {% endfor %}

  422. {% endif %}

  423. 

  424. {% endfor %}

  425. 

  426. 

  427. {% for name, user in pillar.get('users', {}).items()

  428.         if user.absent is defined and user.absent %}

  429. users_absent_user_{{ name }}:

  430. {% if 'purge' in user or 'force' in user %}

  431.   user.absent:

  432.     - name: {{ name }}

  433.     {% if 'purge' in user %}

  434.     - purge: {{ user['purge'] }}

  435.     {% endif %}

  436.     {% if 'force' in user %}

  437.     - force: {{ user['force'] }}

  438.     {% endif %}

  439. {% else %}

  440.   user.absent:

  441.     - name: {{ name }}

  442. {% endif -%}

  443. users_{{ users.sudoers_dir }}/{{ name }}:

  444.   file.absent:

  445.     - name: {{ users.sudoers_dir }}/{{ name }}

  446. {% endfor %}

  447. 

  448. {% for user in pillar.get('absent_users', []) %}

  449. users_absent_user_2_{{ user }}:

  450.   user.absent

  451. users_2_{{ users.sudoers_dir }}/{{ user }}:

  452.   file.absent:

  453.     - name: {{ users.sudoers_dir }}/{{ user }}

  454. {% endfor %}

  455. 

  456. {% for group in pillar.get('absent_groups', []) %}

  457. users_absent_group_{{ group }}:

  458.   group.absent:

  459.     - name: {{ group }}

  460. {% endfor %}