salt
/
users-formula
派生自 ExternalMirrors/users-formula
关注 1
点赞 0
派生 0
代码 版本发布 0 动态
Saltstack Official Users Formula
您最多选择25个主题 主题必须以字母或数字开头，可以包含连字符 (-)，并且长度不得超过35个字符
293 提交
2 分支
目录树: 7ab8f2ed06
分支列表 标签列表
${ item.name }
创建分支 ${ searchTerm }
从 '7ab8f2ed06'
${ noResults }
users-formula/users/init.sls

541 行
16KB
原始文件 Blame 文件历史 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. 

  7. {%- for name, user in pillar.get('users', {}).items()

  8.         if user.absent is not defined or not user.absent %}

  9. {%- if user == None -%}

  10. {%- set user = {} -%}

  11. {%- endif -%}

  12. {%- if 'sudoonly' in user and user['sudoonly'] %}

  13. {%- set _dummy=user.update({'sudouser': True}) %}

  14. {%- endif %}

  15. {%- if 'sudouser' in user and user['sudouser'] %}

  16. {%- do used_sudo.append(1) %}

  17. {%- endif %}

  18. {%- if 'google_auth' in user %}

  19. {%- do used_googleauth.append(1) %}

  20. {%- endif %}

  21. {%- if salt['pillar.get']('users:' ~ name ~ ':user_files:enabled', False) %}

  22. {%- do used_user_files.append(1) %}

  23. {%- endif %}

  24. {%- endfor %}

  25. 

  26. {%- if used_sudo or used_googleauth or used_user_files %}

  27. include:

  28. {%- if used_sudo %}

  29.   - users.sudo

  30. {%- endif %}

  31. {%- if used_googleauth %}

  32.   - users.googleauth

  33. {%- endif %}

  34. {%- if used_user_files %}

  35.   - users.user_files

  36. {%- endif %}

  37. {%- endif %}

  38. 

  39. {% for name, user in pillar.get('users', {}).items()

  40.         if user.absent is not defined or not user.absent %}

  41. {%- if user == None -%}

  42. {%- set user = {} -%}

  43. {%- endif -%}

  44. {%- set current = salt.user.info(name) -%}

  45. {%- set home = user.get('home', current.get('home', "/home/%s" % name)) -%}

  46. 

  47. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  48. {%- set user_group = user.prime_group.name -%}

  49. {%- else -%}

  50. {%- set user_group = name -%}

  51. {%- endif %}

  52. 

  53. {%- if not ( 'sudoonly' in user and user['sudoonly'] ) %}

  54. {% for group in user.get('groups', []) %}

  55. users_{{ name }}_{{ group }}_group:

  56.   group.present:

  57.     - name: {{ group }}

  58.     {% if group == 'sudo' %}

  59.     - system: True

  60.     {% endif %}

  61. {% endfor %}

  62. 

  63. {# in case home subfolder doesn't exist, create it before the user exists #}

  64. {% if user.get('createhome', True) %}

  65. users_{{ name }}_user_prereq:

  66.   file.directory:

  67.     - name: {{ salt['file.dirname'](home) }}

  68.     - makedirs: True

  69.     - prereq:

  70.       - user: users_{{ name }}_user

  71. {%- endif %}

  72. 

  73. users_{{ name }}_user:

  74.   {% if user.get('createhome', True) %}

  75.   file.directory:

  76.     - name: {{ home }}

  77.     - user: {{ user.get('homedir_owner', name) }}

  78.     - group: {{ user.get('homedir_group', user_group) }}

  79.     - mode: {{ user.get('user_dir_mode', '0750') }}

  80.     - makedirs: True

  81.     - require:

  82.       - user: users_{{ name }}_user

  83.       - group: {{ user_group }}

  84.   {%- endif %}

  85.   group.present:

  86.     - name: {{ user_group }}

  87.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  88.     - gid: {{ user['prime_group']['gid'] }}

  89.     {%- elif 'uid' in user %}

  90.     - gid: {{ user['uid'] }}

  91.     {%- endif %}

  92.     {% if 'system' in user and user['system'] %}

  93.     - system: True

  94.     {% endif %}

  95.   user.present:

  96.     - name: {{ name }}

  97.     - home: {{ home }}

  98.     - shell: {{ user.get('shell', current.get('shell', users.get('shell', '/bin/bash'))) }}

  99.     {% if 'uid' in user -%}

  100.     - uid: {{ user['uid'] }}

  101.     {% endif -%}

  102.     {% if 'password' in user -%}

  103.     - password: '{{ user['password'] }}'

  104.     {% endif -%}

  105.     {% if user.get('empty_password') -%}

  106.     - empty_password: {{ user.get('empty_password') }}

  107.     {% endif -%}

  108.     {% if 'enforce_password' in user -%}

  109.     - enforce_password: {{ user['enforce_password'] }}

  110.     {% endif -%}

  111.     {% if 'hash_password' in user -%}

  112.     - hash_password: {{ user['hash_password'] }}

  113.     {% endif -%}

  114.     {% if user.get('system', False) -%}

  115.     - system: True

  116.     {% endif -%}

  117.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  118.     - gid: {{ user['prime_group']['gid'] }}

  119.     {% elif 'prime_group' in user and 'name' in user['prime_group'] %}

  120.     - gid: {{ user['prime_group']['name'] }}

  121.     {% else -%}

  122.     - gid_from_name: True

  123.     {% endif -%}

  124.     {% if 'fullname' in user %}

  125.     - fullname: {{ user['fullname'] }}

  126.     {% endif -%}

  127.     {% if 'roomnumber' in user %}

  128.     - roomnumber: {{ user['roomnumber'] }}

  129.     {% endif %}

  130.     {% if 'workphone' in user %}

  131.     - workphone: {{ user['workphone'] }}

  132.     {% endif %}

  133.     {% if 'homephone' in user %}

  134.     - homephone: {{ user['homephone'] }}

  135.     {% endif %}

  136.     {% if not user.get('createhome', True) %}

  137.     - createhome: False

  138.     {% endif %}

  139.     {% if not user.get('unique', True) %}

  140.     - unique: False

  141.     {% endif %}

  142.     {% if 'expire' in user -%}

  143.         {% if grains['kernel'].endswith('BSD') and

  144.             user['expire'] < 157766400 %}

  145.         {# 157762800s since epoch equals 01 Jan 1975 00:00:00 UTC #}

  146.     - expire: {{ user['expire'] * 86400 }}

  147.         {% elif grains['kernel'] == 'Linux' and

  148.             user['expire'] > 84006 %}

  149.         {# 2932896 days since epoch equals 9999-12-31 #}

  150.     - expire: {{ (user['expire'] / 86400) | int}}

  151.         {% else %}

  152.     - expire: {{ user['expire'] }}

  153.         {% endif %}

  154.     {% endif -%}

  155.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  156.     - groups:

  157.       - {{ user_group }}

  158.       {% for group in user.get('groups', []) -%}

  159.       - {{ group }}

  160.       {% endfor %}

  161.     {% if 'optional_groups' in user %}

  162.     - optional_groups:

  163.       {% for optional_group in user['optional_groups'] -%}

  164.       - {{optional_group}}

  165.       {% endfor %}

  166.     {% endif %}

  167.     - require:

  168.       - group: {{ user_group }}

  169.       {% for group in user.get('groups', []) -%}

  170.       - group: {{ group }}

  171.       {% endfor %}

  172. 

  173. 

  174.   {% if 'ssh_keys' in user or

  175.       'ssh_auth' in user or

  176.       'ssh_auth_file' in user or

  177.       'ssh_auth_pillar' in user or

  178.       'ssh_auth.absent' in user or

  179.       'ssh_config' in user %}

  180. user_keydir_{{ name }}:

  181.   file.directory:

  182.     - name: {{ home }}/.ssh

  183.     - user: {{ name }}

  184.     - group: {{ user_group }}

  185.     - makedirs: True

  186.     - mode: 700

  187.     - require:

  188.       - user: {{ name }}

  189.       - group: {{ user_group }}

  190.       {%- for group in user.get('groups', []) %}

  191.       - group: {{ group }}

  192.       {%- endfor %}

  193.   {% endif %}

  194. 

  195.   {% if 'ssh_keys' in user %}

  196.     {% for _key in user.ssh_keys.keys() %}

  197.       {% if _key == 'privkey' %}

  198.         {% set key_name = 'id_' + user.get('ssh_key_type', 'rsa') %}

  199.       {% elif _key ==  'pubkey' %}

  200.         {% set key_name = 'id_' + user.get('ssh_key_type', 'rsa') + '.pub' %}

  201.       {% else %}

  202.         {% set key_name = _key %}

  203.       {% endif %}

  204. users_{{ name }}_{{ key_name }}_key:

  205.   file.managed:

  206.     - name: {{ home }}/.ssh/{{ key_name }}

  207.     - user: {{ name }}

  208.     - group: {{ user_group }}

  209.       {% if key_name.endswith(".pub") %}

  210.     - mode: 644

  211.       {% else %}

  212.     - mode: 600

  213.       {% endif %}

  214.     - show_diff: False

  215.     {%- set key_value = salt['pillar.get']('users:'+name+':ssh_keys:'+_key) %}

  216.     {%- if 'salt://' in key_value[:7] %}

  217.     - source: {{ key_value }}

  218.     {%- else %}

  219.     - contents_pillar: users:{{ name }}:ssh_keys:{{ _key }}

  220.     {%- endif %}

  221.     - require:

  222.       - user: users_{{ name }}_user

  223.       {% for group in user.get('groups', []) %}

  224.       - group: users_{{ name }}_{{ group }}_group

  225.       {% endfor %}

  226.     {% endfor %}

  227.   {% endif %}

  228. 

  229. 

  230. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  231. users_authorized_keys_{{ name }}:

  232.   file.managed:

  233.     - name: {{ home }}/.ssh/authorized_keys

  234.     - user: {{ name }}

  235.     - group: {{ user_group }}

  236.     - mode: 600

  237. {% if 'ssh_auth_file' in user %}

  238.     - contents: |

  239.         {% for auth in user.ssh_auth_file -%}

  240.         {{ auth }}

  241.         {% endfor -%}

  242. {% else %}

  243.     - contents: |

  244.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].items() %}

  245.         {{ salt['pillar.get'](pillar_name + ':' + key_name + ':pubkey', '') }}

  246.         {%- endfor %}

  247. {% endif %}

  248. {% endif %}

  249. 

  250. {% if 'ssh_auth' in user %}

  251. {% for auth in user['ssh_auth'] %}

  252. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  253.   ssh_auth.present:

  254.     - user: {{ name }}

  255.     - name: {{ auth }}

  256.     - require:

  257.         - file: user_keydir_{{ name }}

  258.         - user: users_{{ name }}_user

  259. {% endfor %}

  260. {% endif %}

  261. 

  262. {% if 'ssh_keys_pillar' in user %}

  263. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  264. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  265.   file.managed:

  266.     - name: {{ home }}/.ssh/{{ key_name }}

  267.     - user: {{ name }}

  268.     - group: {{ user_group }}

  269.     - mode: 600

  270.     - show_diff: False

  271.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  272.     - require:

  273.       - user: users_{{ name }}_user

  274.       {% for group in user.get('groups', []) %}

  275.       - group: users_{{ name }}_{{ group }}_group

  276.       {% endfor %}

  277. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  278.   file.managed:

  279.     - name: {{ home }}/.ssh/{{ key_name }}.pub

  280.     - user: {{ name }}

  281.     - group: {{ user_group }}

  282.     - mode: 644

  283.     - show_diff: False

  284.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  285.     - require:

  286.       - user: users_{{ name }}_user

  287.       {% for group in user.get('groups', []) %}

  288.       - group: users_{{ name }}_{{ group }}_group

  289.       {% endfor %}

  290. {% endfor %}

  291. {% endif %}

  292. 

  293. {% if 'ssh_auth_sources' in user %}

  294. {% for pubkey_file in user['ssh_auth_sources'] %}

  295. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  296.   ssh_auth.present:

  297.     - user: {{ name }}

  298.     - source: {{ pubkey_file }}

  299.     - require:

  300.         - file: users_{{ name }}_user

  301.         - user: users_{{ name }}_user

  302. {% endfor %}

  303. {% endif %}

  304. 

  305. {% if 'ssh_auth_sources.absent' in user %}

  306. {% for pubkey_file in user['ssh_auth_sources.absent'] %}

  307. users_ssh_auth_source_delete_{{ name }}_{{ loop.index0 }}:

  308.   ssh_auth.absent:

  309.     - user: {{ name }}

  310.     - source: {{ pubkey_file }}

  311.     - require:

  312.         - file: users_{{ name }}_user

  313.         - user: users_{{ name }}_user

  314. {% endfor %}

  315. {% endif %}

  316. 

  317. {% if 'ssh_auth.absent' in user %}

  318. {% for auth in user['ssh_auth.absent'] %}

  319. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  320.   ssh_auth.absent:

  321.     - user: {{ name }}

  322.     - name: {{ auth }}

  323.     - require:

  324.         - file: users_{{ name }}_user

  325.         - user: users_{{ name }}_user

  326. {% endfor %}

  327. {% endif %}

  328. 

  329. {% if 'ssh_config' in user %}

  330. users_ssh_config_{{ name }}:

  331.   file.managed:

  332.     - name: {{ home }}/.ssh/config

  333.     - user: {{ name }}

  334.     - group: {{ user_group }}

  335.     - mode: 640

  336.     - contents: |

  337.         # Managed by Saltstack

  338.         # Do Not Edit

  339.         {% for label, setting in user.ssh_config.items() %}

  340.         # {{ label }}

  341.         Host {{ setting.get('hostname') }}

  342.           {%- for opts in setting.get('options') %}

  343.           {{ opts }}

  344.           {%- endfor %}

  345.         {% endfor -%}

  346. {% endif %}

  347. 

  348. {% if 'ssh_known_hosts' in user %}

  349. {% for hostname, host in user['ssh_known_hosts'].items() %}

  350. users_ssh_known_hosts_{{ name }}_{{ loop.index0 }}:

  351.   ssh_known_hosts.present:

  352.     - user: {{ name }}

  353.     - name: {{ hostname }}

  354.     {% if 'port' in host %}

  355.     - port: {{ host['port'] }}

  356.     {% endif -%}

  357.     {% if 'fingerprint' in host %}

  358.     - fingerprint: {{ host['fingerprint'] }}

  359.     {% endif -%}

  360.     {% if 'key' in host %}

  361.     - key: {{ host['key'] }}

  362.     {% endif -%}

  363.     {% if 'enc' in host %}

  364.     - enc: {{ host['enc'] }}

  365.     {% endif -%}

  366.     {% if 'hash_hostname' in host %}

  367.     - hash_hostname: {{ host['hash_hostname'] }}

  368.     {% endif -%}

  369. {% endfor %}

  370. {% endif %}

  371. 

  372. {% if 'ssh_known_hosts.absent' in user %}

  373. {% for host in user['ssh_known_hosts.absent'] %}

  374. users_ssh_known_hosts_delete_{{ name }}_{{ loop.index0 }}:

  375.   ssh_known_hosts.absent:

  376.     - user: {{ name }}

  377.     - name: {{ host }}

  378. {% endfor %}

  379. {% endif %}

  380. {% endif %}

  381. 

  382. {% set sudoers_d_filename = name|replace('.','_') %}

  383. {% if 'sudouser' in user and user['sudouser'] %}

  384. 

  385. users_sudoer-{{ name }}:

  386.   file.managed:

  387.     - replace: False

  388.     - name: {{ users.sudoers_dir }}/{{ sudoers_d_filename }}

  389.     - user: root

  390.     - group: {{ users.root_group }}

  391.     - mode: '0440'

  392. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  393. #{#%

  394. {% if 'sudo_rules' in user %}

  395. {% for rule in user['sudo_rules'] %}

  396. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  397.   cmd.run:

  398.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  399.     - stateful: True

  400.     - shell: {{ users.visudo_shell }}

  401.     - env:

  402.       # Specify the rule via an env var to avoid shell quoting issues.

  403.       - rule: "{{ name }} {{ rule }}"

  404.     - require_in:

  405.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  406. {% endfor %}

  407. {% endif %}

  408. {% if 'sudo_defaults' in user %}

  409. {% for entry in user['sudo_defaults'] %}

  410. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  411.   cmd.run:

  412.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  413.     - stateful: True

  414.     - shell: {{ users.visudo_shell }}

  415.     - env:

  416.       # Specify the rule via an env var to avoid shell quoting issues.

  417.       - rule: "Defaults:{{ name }} {{ entry }}"

  418.     - require_in:

  419.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  420. {% endfor %}

  421. {% endif %}

  422. #%#}

  423. 

  424. users_{{ users.sudoers_dir }}/{{ name }}:

  425.   file.managed:

  426.     - replace: True

  427.     - name: {{ users.sudoers_dir }}/{{ sudoers_d_filename }}

  428.     - contents: |

  429.       {%- if 'sudo_defaults' in user %}

  430.       {%- for entry in user['sudo_defaults'] %}

  431.         Defaults:{{ name }} {{ entry }}

  432.       {%- endfor %}

  433.       {%- endif %}

  434.       {%- if 'sudo_rules' in user %}

  435.         ########################################################################

  436.         # File managed by Salt (users-formula).

  437.         # Your changes will be overwritten.

  438.         ########################################################################

  439.         #

  440.       {%- for rule in user['sudo_rules'] %}

  441.         {{ name }} {{ rule }}

  442.       {%- endfor %}

  443.       {%- endif %}

  444.     - require:

  445.       - file: users_sudoer-defaults

  446.       - file: users_sudoer-{{ name }}

  447.   cmd.wait:

  448.     - name: visudo -cf {{ users.sudoers_dir }}/{{ sudoers_d_filename }} || ( rm -rvf {{ users.sudoers_dir }}/{{ sudoers_d_filename }}; exit 1 )

  449.     - watch:

  450.       - file: {{ users.sudoers_dir }}/{{ sudoers_d_filename }}

  451. {% endif %}

  452. {% else %}

  453. users_{{ users.sudoers_dir }}/{{ sudoers_d_filename }}:

  454.   file.absent:

  455.     - name: {{ users.sudoers_dir }}/{{ sudoers_d_filename }}

  456. {% endif %}

  457. 

  458. {%- if 'google_auth' in user %}

  459. {%- for svc in user['google_auth'] %}

  460. users_googleauth-{{ svc }}-{{ name }}:

  461.   file.managed:

  462.     - replace: false

  463.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  464.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  465.     - user: root

  466.     - group: {{ users.root_group }}

  467.     - mode: 400

  468.     - require:

  469.       - pkg: users_googleauth-package

  470. {%- endfor %}

  471. {%- endif %}

  472. 

  473. # this doesn't work (Salt bug), therefore need to run state.apply twice

  474. #include:

  475. #  - users

  476. #

  477. #git:

  478. #  pkg.installed:

  479. #    - require_in:

  480. #      - sls: users

  481. #

  482. {% if 'gitconfig' in user %}

  483. {% if salt['cmd.has_exec']('git') %}

  484. {% for key, value in user['gitconfig'].items() %}

  485. users_{{ name }}_user_gitconfig_{{ loop.index0 }}:

  486.   {% if grains['saltversioninfo'] >= [2015, 8, 0, 0] %}

  487.   git.config_set:

  488.   {% else %}

  489.   git.config:

  490.   {% endif %}

  491.     - name: {{ key }}

  492.     - value: "{{ value }}"

  493.     - user: {{ name }}

  494.     {% if grains['saltversioninfo'] >= [2015, 8, 0, 0] %}

  495.     - global: True

  496.     {% else %}

  497.     - is_global: True

  498.     {% endif %}

  499. {% endfor %}

  500. {% endif %}

  501. {% endif %}

  502. 

  503. {% endfor %}

  504. 

  505. 

  506. {% for name, user in pillar.get('users', {}).items()

  507.         if user.absent is defined and user.absent %}

  508. users_absent_user_{{ name }}:

  509. {% if 'purge' in user or 'force' in user %}

  510.   user.absent:

  511.     - name: {{ name }}

  512.     {% if 'purge' in user %}

  513.     - purge: {{ user['purge'] }}

  514.     {% endif %}

  515.     {% if 'force' in user %}

  516.     - force: {{ user['force'] }}

  517.     {% endif %}

  518. {% else %}

  519.   user.absent:

  520.     - name: {{ name }}

  521. {% endif -%}

  522. users_{{ users.sudoers_dir }}/{{ name }}:

  523.   file.absent:

  524.     - name: {{ users.sudoers_dir }}/{{ name }}

  525. {% endfor %}

  526. 

  527. {% for user in pillar.get('absent_users', []) %}

  528. users_absent_user_2_{{ user }}:

  529.   user.absent:

  530.     - name: {{ user }}

  531. users_2_{{ users.sudoers_dir }}/{{ user }}:

  532.   file.absent:

  533.     - name: {{ users.sudoers_dir }}/{{ user }}

  534. {% endfor %}

  535. 

  536. {% for group in pillar.get('absent_groups', []) %}

  537. users_absent_group_{{ group }}:

  538.   group.absent:

  539.     - name: {{ group }}

  540. {% endfor %}