salt
/
users-formula
geforkt von ExternalMirrors/users-formula
Beobachten 1
Favorisieren 0
Fork 0
Code Releases 0 Aktivität
Saltstack Official Users Formula
Du kannst nicht mehr als 25 Themen auswählen Themen müssen entweder mit einem Buchstaben oder einer Ziffer beginnen. Sie können Bindestriche („-“) enthalten und bis zu 35 Zeichen lang sein.
178 Commits
2 Branches
Struktur: 76f646ec06
Branches Tags
${ item.name }
Erstelle Branch ${ searchTerm }
von „76f646ec06“
${ noResults }
users-formula/users/init.sls

463 Zeilen
13KB
Originalformat Blame Verlauf 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. 

  7. {%- for name, user in pillar.get('users', {}).items()

  8.         if user.absent is not defined or not user.absent %}

  9. {%- if user == None -%}

  10. {%- set user = {} -%}

  11. {%- endif -%}

  12. {%- if 'sudouser' in user and user['sudouser'] %}

  13. {%- do used_sudo.append(1) %}

  14. {%- endif %}

  15. {%- if 'google_auth' in user %}

  16. {%- do used_googleauth.append(1) %}

  17. {%- endif %}

  18. {%- if salt['pillar.get']('users:' ~ name ~ ':user_files:enabled', False) %}

  19. {%- do used_user_files.append(1) %}

  20. {%- endif %}

  21. {%- endfor %}

  22. 

  23. {%- if used_sudo or used_googleauth or used_user_files %}

  24. include:

  25. {%- if used_sudo %}

  26.   - users.sudo

  27. {%- endif %}

  28. {%- if used_googleauth %}

  29.   - users.googleauth

  30. {%- endif %}

  31. {%- if used_user_files %}

  32.   - users.user_files

  33. {%- endif %}

  34. {%- endif %}

  35. 

  36. {% for name, user in pillar.get('users', {}).items()

  37.         if user.absent is not defined or not user.absent %}

  38. {%- if user == None -%}

  39. {%- set user = {} -%}

  40. {%- endif -%}

  41. {%- set home = user.get('home', "/home/%s" % name) -%}

  42. 

  43. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  44. {%- set user_group = user.prime_group.name -%}

  45. {%- else -%}

  46. {%- set user_group = name -%}

  47. {%- endif %}

  48. 

  49. {% for group in user.get('groups', []) %}

  50. users_{{ name }}_{{ group }}_group:

  51.   group.present:

  52.     - name: {{ group }}

  53.     {% if group == 'sudo' %}

  54.     - system: True

  55.     {% endif %}

  56. {% endfor %}

  57. 

  58. users_{{ name }}_user:

  59.   {% if user.get('createhome', True) %}

  60.   file.directory:

  61.     - name: {{ home }}

  62.     - user: {{ name }}

  63.     - group: {{ user_group }}

  64.     - mode: {{ user.get('user_dir_mode', '0750') }}

  65.     - require:

  66.       - user: users_{{ name }}_user

  67.       - group: {{ user_group }}

  68.   {%- endif %}

  69.   group.present:

  70.     - name: {{ user_group }}

  71.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  72.     - gid: {{ user['prime_group']['gid'] }}

  73.     {%- elif 'uid' in user %}

  74.     - gid: {{ user['uid'] }}

  75.     {%- endif %}

  76.   user.present:

  77.     - name: {{ name }}

  78.     - home: {{ home }}

  79.     - shell: {{ user.get('shell', users.get('shell', '/bin/bash')) }}

  80.     {% if 'uid' in user -%}

  81.     - uid: {{ user['uid'] }}

  82.     {% endif -%}

  83.     {% if 'password' in user -%}

  84.     - password: '{{ user['password'] }}'

  85.     {% endif -%}

  86.     {% if user.get('empty_password') -%}

  87.     - empty_password: {{ user.get('empty_password') }}

  88.     {% endif -%}

  89.     {% if 'enforce_password' in user -%}

  90.     - enforce_password: {{ user['enforce_password'] }}

  91.     {% endif -%}

  92.     {% if user.get('system', False) -%}

  93.     - system: True

  94.     {% endif -%}

  95.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  96.     - gid: {{ user['prime_group']['gid'] }}

  97.     {% else -%}

  98.     - gid_from_name: True

  99.     {% endif -%}

  100.     {% if 'fullname' in user %}

  101.     - fullname: {{ user['fullname'] }}

  102.     {% endif -%}

  103.     {% if 'roomnumber' in user %}

  104.     - roomnumber: {{ user['roomnumber'] }}

  105.     {% endif %}

  106.     {% if 'workphone' in user %}

  107.     - workphone: {{ user['workphone'] }}

  108.     {% endif %}

  109.     {% if 'homephone' in user %}

  110.     - homephone: {{ user['workphone'] }}

  111.     {% endif %}

  112.     {% if not user.get('createhome', True) %}

  113.     - createhome: False

  114.     {% endif %}

  115.     {% if 'expire' in user -%}

  116.     - expire: {{ user['expire'] }}

  117.     {% endif -%}

  118.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  119.     - groups:

  120.       - {{ user_group }}

  121.       {% for group in user.get('groups', []) -%}

  122.       - {{ group }}

  123.       {% endfor %}

  124.     - require:

  125.       - group: {{ user_group }}

  126.       {% for group in user.get('groups', []) -%}

  127.       - group: {{ group }}

  128.       {% endfor %}

  129. 

  130. 

  131.   {% if 'ssh_keys' in user or

  132.       'ssh_auth' in user or

  133.       'ssh_auth_file' in user or

  134.       'ssh_auth.absent' in user or

  135.       'ssh_config' in user %}

  136. user_keydir_{{ name }}:

  137.   file.directory:

  138.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh

  139.     - user: {{ name }}

  140.     - group: {{ user_group }}

  141.     - makedirs: True

  142.     - mode: 700

  143.     - require:

  144.       - user: {{ name }}

  145.       - group: {{ user_group }}

  146.       {%- for group in user.get('groups', []) %}

  147.       - group: {{ group }}

  148.       {%- endfor %}

  149.   {% endif %}

  150. 

  151.   {% if 'ssh_keys' in user %}

  152.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  153. users_user_{{ name }}_private_key:

  154.   file.managed:

  155.     - name: {{ user.get('home',

  156.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}

  157.     - user: {{ name }}

  158.     - group: {{ user_group }}

  159.     - mode: 600

  160.     - show_diff: False

  161.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  162.     - require:

  163.       - user: users_{{ name }}_user

  164.       {% for group in user.get('groups', []) %}

  165.       - group: users_{{ name }}_{{ group }}_group

  166.       {% endfor %}

  167. users_user_{{ name }}_public_key:

  168.   file.managed:

  169.     - name: {{ user.get('home',

  170.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}.pub

  171.     - user: {{ name }}

  172.     - group: {{ user_group }}

  173.     - mode: 644

  174.     - show_diff: False

  175.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  176.     - require:

  177.       - user: users_{{ name }}_user

  178.       {% for group in user.get('groups', []) %}

  179.       - group: users_{{ name }}_{{ group }}_group

  180.       {% endfor %}

  181.   {% endif %}

  182. 

  183. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  184. users_authorized_keys_{{ name }}:

  185.   file.managed:

  186.     - name: {{ home }}/.ssh/authorized_keys

  187.     - user: {{ name }}

  188.     - group: {{ name }}

  189.     - mode: 600

  190. {% if 'ssh_auth_file' in user %}

  191.     - contents: |

  192.         {% for auth in user.ssh_auth_file -%}

  193.         {{ auth }}

  194.         {% endfor -%}

  195. {% else %}

  196.     - contents: |

  197.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].iteritems() %}

  198.         {{ salt['pillar.get'](pillar_name + ':' + key_name + ':pubkey', '') }}

  199.         {%- endfor %}

  200. {% endif %}

  201. {% endif %}

  202. 

  203. {% if 'ssh_auth' in user %}

  204. {% for auth in user['ssh_auth'] %}

  205. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  206.   ssh_auth.present:

  207.     - user: {{ name }}

  208.     - name: {{ auth }}

  209.     - require:

  210.         - file: users_{{ name }}_user

  211.         - user: users_{{ name }}_user

  212. {% endfor %}

  213. {% endif %}

  214. 

  215. {% if 'ssh_keys_pillar' in user %}

  216. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  217. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  218.   file.managed:

  219.     - name: {{ user.get('home',

  220.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}

  221.     - user: {{ name }}

  222.     - group: {{ user_group }}

  223.     - mode: 600

  224.     - show_diff: False

  225.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  226.     - require:

  227.       - user: users_{{ name }}_user

  228.       {% for group in user.get('groups', []) %}

  229.       - group: users_{{ name }}_{{ group }}_group

  230.       {% endfor %}

  231. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  232.   file.managed:

  233.     - name: {{ user.get('home',

  234.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}.pub

  235.     - user: {{ name }}

  236.     - group: {{ user_group }}

  237.     - mode: 644

  238.     - show_diff: False

  239.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  240.     - require:

  241.       - user: users_{{ name }}_user

  242.       {% for group in user.get('groups', []) %}

  243.       - group: users_{{ name }}_{{ group }}_group

  244.       {% endfor %}

  245. {% endfor %}

  246. {% endif %}

  247. 

  248. {% if 'ssh_auth_sources' in user %}

  249. {% for pubkey_file in user['ssh_auth_sources'] %}

  250. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  251.   ssh_auth.present:

  252.     - user: {{ name }}

  253.     - source: {{ pubkey_file }}

  254.     - require:

  255.         - file: users_{{ name }}_user

  256.         - user: users_{{ name }}_user

  257. {% endfor %}

  258. {% endif %}

  259. 

  260. {% if 'ssh_auth.absent' in user %}

  261. {% for auth in user['ssh_auth.absent'] %}

  262. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  263.   ssh_auth.absent:

  264.     - user: {{ name }}

  265.     - name: {{ auth }}

  266.     - require:

  267.         - file: users_{{ name }}_user

  268.         - user: users_{{ name }}_user

  269. {% endfor %}

  270. {% endif %}

  271. 

  272. {% if 'ssh_config' in user %}

  273. users_ssh_config_{{ name }}:

  274.   file.managed:

  275.     - name: {{ home }}/.ssh/config

  276.     - user: {{ name }}

  277.     - group: {{ user_group }}

  278.     - mode: 640

  279.     - contents: |

  280.         # Managed by Saltstack

  281.         # Do Not Edit

  282.         {% for label, setting in user.ssh_config.items() %}

  283.         # {{ label }}

  284.         Host {{ setting.get('hostname') }}

  285.           {%- for opts in setting.get('options') %}

  286.           {{ opts }}

  287.           {%- endfor %}

  288.         {% endfor -%}

  289. {% endif %}

  290. 

  291. {% if 'ssh_known_hosts' in user %}

  292. {% for hostname, host in user['ssh_known_hosts'].items() %}

  293. users_ssh_known_hosts_{{ name }}_{{ loop.index0 }}:

  294.   ssh_known_hosts.present:

  295.     - user: {{ name }}

  296.     - name: {{ hostname }}

  297.     {% if 'port' in host %}

  298.     - port: {{ host['port'] }}

  299.     {% endif -%}

  300.     {% if 'fingerprint' in host %}

  301.     - fingerprint: {{ host['fingerprint'] }}

  302.     {% endif -%}

  303.     {% if 'key' in host %}

  304.     - key: {{ host['key'] }}

  305.     {% endif -%}

  306.     {% if 'enc' in host %}

  307.     - enc: {{ host['enc'] }}

  308.     {% endif -%}

  309.     {% if 'hash_hostname' in host %}

  310.     - hash_hostname: {{ host['hash_hostname'] }}

  311.     {% endif -%}

  312. {% endfor %}

  313. {% endif %}

  314. 

  315. {% if 'ssh_known_hosts.absent' in user %}

  316. {% for host in user['ssh_known_hosts.absent'] %}

  317. users_ssh_known_hosts_delete_{{ name }}_{{ loop.index0 }}:

  318.   ssh_known_hosts.absent:

  319.     - user: {{ name }}

  320.     - name: {{ host }}

  321. {% endfor %}

  322. {% endif %}

  323. 

  324. {% if 'sudouser' in user and user['sudouser'] %}

  325. 

  326. users_sudoer-{{ name }}:

  327.   file.managed:

  328.     - name: {{ users.sudoers_dir }}/{{ name }}

  329.     - user: root

  330.     - group: {{ users.root_group }}

  331.     - mode: '0440'

  332. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  333. #{#%

  334. {% if 'sudo_rules' in user %}

  335. {% for rule in user['sudo_rules'] %}

  336. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  337.   cmd.run:

  338.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  339.     - stateful: True

  340.     - shell: {{ users.visudo_shell }}

  341.     - env:

  342.       # Specify the rule via an env var to avoid shell quoting issues.

  343.       - rule: "{{ name }} {{ rule }}"

  344.     - require_in:

  345.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  346. {% endfor %}

  347. {% endif %}

  348. {% if 'sudo_defaults' in user %}

  349. {% for entry in user['sudo_defaults'] %}

  350. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  351.   cmd.run:

  352.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  353.     - stateful: True

  354.     - shell: {{ users.visudo_shell }}

  355.     - env:

  356.       # Specify the rule via an env var to avoid shell quoting issues.

  357.       - rule: "Defaults:{{ name }} {{ entry }}"

  358.     - require_in:

  359.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  360. {% endfor %}

  361. {% endif %}

  362. #%#}

  363. 

  364. users_{{ users.sudoers_dir }}/{{ name }}:

  365.   file.managed:

  366.     - name: {{ users.sudoers_dir }}/{{ name }}

  367.     - contents: |

  368.       {%- if 'sudo_defaults' in user %}

  369.       {%- for entry in user['sudo_defaults'] %}

  370.         Defaults:{{ name }} {{ entry }}

  371.       {%- endfor %}

  372.       {%- endif %}

  373.       {%- if 'sudo_rules' in user %}

  374.       {%- for rule in user['sudo_rules'] %}

  375.         {{ name }} {{ rule }}

  376.       {%- endfor %}

  377.       {%- endif %}

  378.     - require:

  379.       - file: users_sudoer-defaults

  380.       - file: users_sudoer-{{ name }}

  381.   cmd.wait:                                                                           

  382.     - name: visudo -cf {{ users.sudoers_dir }}/{{ name }} || ( rm -rvf {{ users.sudoers_dir }}/{{ name }}; exit 1 )

  383.     - watch:                                                                         

  384.       - file: {{ users.sudoers_dir }}/{{ name }}   

  385. {% endif %}

  386. {% else %}

  387. users_{{ users.sudoers_dir }}/{{ name }}:

  388.   file.absent:

  389.     - name: {{ users.sudoers_dir }}/{{ name }}

  390. {% endif %}

  391. 

  392. {%- if 'google_auth' in user %}

  393. {%- for svc in user['google_auth'] %}

  394. users_googleauth-{{ svc }}-{{ name }}:

  395.   file.managed:

  396.     - replace: false

  397.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  398.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  399.     - user: root

  400.     - group: {{ users.root_group }}

  401.     - mode: 400

  402.     - require:

  403.       - pkg: users_googleauth-package

  404. {%- endfor %}

  405. {%- endif %}

  406. 

  407. {% if 'gitconfig' in user %}

  408. {% for key, value in user['gitconfig'].items() %}

  409. users_{{ name }}_user_gitconfig_{{ loop.index0 }}:

  410.   {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  411.   git.config_set:

  412.   {% else %}

  413.   git.config:

  414.   {% endif %}

  415.     - name: {{ key }}

  416.     - value: "{{ value }}"

  417.     - user: {{ name }}

  418.     {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  419.     - global: True

  420.     {% else %}

  421.     - is_global: True

  422.     {% endif %}

  423. {% endfor %}

  424. {% endif %}

  425. 

  426. {% endfor %}

  427. 

  428. 

  429. {% for name, user in pillar.get('users', {}).items()

  430.         if user.absent is defined and user.absent %}

  431. users_absent_user_{{ name }}:

  432. {% if 'purge' in user or 'force' in user %}

  433.   user.absent:

  434.     - name: {{ name }}

  435.     {% if 'purge' in user %}

  436.     - purge: {{ user['purge'] }}

  437.     {% endif %}

  438.     {% if 'force' in user %}

  439.     - force: {{ user['force'] }}

  440.     {% endif %}

  441. {% else %}

  442.   user.absent:

  443.     - name: {{ name }}

  444. {% endif -%}

  445. users_{{ users.sudoers_dir }}/{{ name }}:

  446.   file.absent:

  447.     - name: {{ users.sudoers_dir }}/{{ name }}

  448. {% endfor %}

  449. 

  450. {% for user in pillar.get('absent_users', []) %}

  451. users_absent_user_2_{{ user }}:

  452.   user.absent

  453. users_2_{{ users.sudoers_dir }}/{{ user }}:

  454.   file.absent:

  455.     - name: {{ users.sudoers_dir }}/{{ user }}

  456. {% endfor %}

  457. 

  458. {% for group in pillar.get('absent_groups', []) %}

  459. users_absent_group_{{ group }}:

  460.   group.absent:

  461.     - name: {{ group }}

  462. {% endfor %}