salt
/
users-formula
atdalīts no ExternalMirrors/users-formula
Vērot 1
Pievienot zvaigznīti 0
Atdalīts 0
Kods Laidieni 0 Aktivitāte
Saltstack Official Users Formula
Nevar pievienot vairāk kā 25 tēmas Tēmai ir jāsākas ar burtu vai ciparu, tā var saturēt domu zīmes ('-') un var būt līdz 35 simboliem gara.
138 Revīzijas
2 Atzari
Koks: 7dda5571db
Atzari Tagi
${ item.name }
Izveidot atzaru ${ searchTerm }
no '7dda5571db'
${ noResults }
users-formula/users/init.sls

349 rindas
9.9KB
Neapstrādāts Vainot Vēsture 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. 

  6. {%- for name, user in pillar.get('users', {}).iteritems() if user.absent is not defined or not user.absent %}

  7. {%- if user == None -%}

  8. {%- set user = {} -%}

  9. {%- endif -%}

  10. {%- if 'sudouser' in user and user['sudouser'] %}

  11. {%- do used_sudo.append(1) %}

  12. {%- endif %}

  13. {%- if 'google_auth' in user %}

  14. {%- do used_googleauth.append(1) %}

  15. {%- endif %}

  16. {%- endfor %}

  17. 

  18. {%- if used_sudo or used_googleauth %}

  19. include:

  20. {%- if used_sudo %}

  21.   - users.sudo

  22. {%- endif %}

  23. {%- if used_googleauth %}

  24.   - users.googleauth

  25. {%- endif %}

  26. {%- endif %}

  27. 

  28. {% for name, user in pillar.get('users', {}).iteritems() if user.absent is not defined or not user.absent %}

  29. {%- if user == None -%}

  30. {%- set user = {} -%}

  31. {%- endif -%}

  32. {%- set home = user.get('home', "/home/%s" % name) -%}

  33. 

  34. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  35. {%- set user_group = user.prime_group.name -%}

  36. {%- else -%}

  37. {%- set user_group = name -%}

  38. {%- endif %}

  39. 

  40. {% for group in user.get('groups', []) %}

  41. users_{{ name }}_{{ group }}_group:

  42.   group:

  43.     - name: {{ group }}

  44.     - present

  45. {% endfor %}

  46. 

  47. users_{{ name }}_user:

  48.   {% if user.get('createhome', True) %}

  49.   file.directory:

  50.     - name: {{ home }}

  51.     - user: {{ name }}

  52.     - group: {{ user_group }}

  53.     - mode: {{ user.get('user_dir_mode', '0750') }}

  54.     - require:

  55.       - user: users_{{ name }}_user

  56.       - group: {{ user_group }}

  57.   {%- endif %}

  58.   group.present:

  59.     - name: {{ user_group }}

  60.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  61.     - gid: {{ user['prime_group']['gid'] }}

  62.     {%- elif 'uid' in user %}

  63.     - gid: {{ user['uid'] }}

  64.     {%- endif %}

  65.   user.present:

  66.     - name: {{ name }}

  67.     - home: {{ home }}

  68.     - shell: {{ user.get('shell', users.get('shell', '/bin/bash')) }}

  69.     {% if 'uid' in user -%}

  70.     - uid: {{ user['uid'] }}

  71.     {% endif -%}

  72.     {% if 'password' in user -%}

  73.     - password: '{{ user['password'] }}'

  74.     {% endif -%}

  75.     {% if user.get('system', False) -%}

  76.     - system: True

  77.     {% endif -%}

  78.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  79.     - gid: {{ user['prime_group']['gid'] }}

  80.     {% else -%}

  81.     - gid_from_name: True

  82.     {% endif -%}

  83.     {% if 'fullname' in user %}

  84.     - fullname: {{ user['fullname'] }}

  85.     {% endif -%}

  86.     {% if not user.get('createhome', True) %}

  87.     - createhome: False

  88.     {% endif %}

  89.     {% if 'expire' in user -%}

  90.     - expire: {{ user['expire'] }}

  91.     {% endif -%}

  92.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  93.     - groups:

  94.       - {{ user_group }}

  95.       {% for group in user.get('groups', []) -%}

  96.       - {{ group }}

  97.       {% endfor %}

  98.     - require:

  99.       - group: {{ user_group }}

  100.       {% for group in user.get('groups', []) -%}

  101.       - group: {{ group }}

  102.       {% endfor %}

  103. 

  104. 

  105.   {% if 'ssh_keys' in user or 'ssh_auth' in user or 'ssh_auth_file' in user or 'ssh_auth.absent' in user %}

  106. user_keydir_{{ name }}:

  107.   file.directory:

  108.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh

  109.     - user: {{ name }}

  110.     - group: {{ user_group }}

  111.     - makedirs: True

  112.     - mode: 700

  113.     - require:

  114.       - user: {{ name }}

  115.       - group: {{ user_group }}

  116.       {%- for group in user.get('groups', []) %}

  117.       - group: {{ group }}

  118.       {%- endfor %}

  119.   {% endif %}

  120. 

  121.   {% if 'ssh_keys' in user %}

  122.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  123. users_user_{{ name }}_private_key:

  124.   file.managed:

  125.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}

  126.     - user: {{ name }}

  127.     - group: {{ user_group }}

  128.     - mode: 600

  129.     - show_diff: False

  130.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  131.     - require:

  132.       - user: users_{{ name }}_user

  133.       {% for group in user.get('groups', []) %}

  134.       - group: users_{{ name }}_{{ group }}_group

  135.       {% endfor %}

  136. users_user_{{ name }}_public_key:

  137.   file.managed:

  138.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}.pub

  139.     - user: {{ name }}

  140.     - group: {{ user_group }}

  141.     - mode: 644

  142.     - show_diff: False

  143.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  144.     - require:

  145.       - user: users_{{ name }}_user

  146.       {% for group in user.get('groups', []) %}

  147.       - group: users_{{ name }}_{{ group }}_group

  148.       {% endfor %}

  149.   {% endif %}

  150. 

  151. {% if 'ssh_auth_file' in user %}

  152. users_authorized_keys_{{ name }}:

  153.   file.managed:

  154.     - name: {{ home }}/.ssh/authorized_keys

  155.     - user: {{ name }}

  156.     - group: {{ name }}

  157.     - mode: 600

  158.     - contents: |

  159.         {% for auth in user.ssh_auth_file -%}

  160.         {{ auth }}

  161.         {% endfor -%}

  162. {% endif %}

  163. 

  164. {% if 'ssh_auth' in user %}

  165. {% for auth in user['ssh_auth'] %}

  166. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  167.   ssh_auth.present:

  168.     - user: {{ name }}

  169.     - name: {{ auth }}

  170.     - require:

  171.         - file: users_{{ name }}_user

  172.         - user: users_{{ name }}_user

  173. {% endfor %}

  174. {% endif %}

  175. 

  176. {% if 'ssh_keys_pillar' in user %}

  177. {% for key_name, pillar_name in user['ssh_keys_pillar'].iteritems()  %}

  178. users_ssh_keys_files_{{ name }}_{{ key_name }}_pub:

  179.   file.managed:

  180.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_name

  181.     }}.pub

  182.     - contents: |

  183.         {{ pillar[pillar_name][key_name]['pubkey'] }}

  184. users_ssh_keys_files_{{ name }}_{{ key_name }}_priv:

  185.   file.managed:

  186.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_name

  187.     }}

  188.     - contents: |

  189.         {{ pillar[pillar_name][key_name]['privkey'] | indent(8) }}

  190. {% endfor %}

  191. {% endif %}

  192. 

  193. {% if 'ssh_auth_sources' in user %}

  194. {% for pubkey_file in user['ssh_auth_sources'] %}

  195. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  196.   ssh_auth.present:

  197.     - user: {{ name }}

  198.     - source: {{ pubkey_file }}

  199.     - require:

  200.         - file: users_{{ name }}_user

  201.         - user: users_{{ name }}_user

  202. {% endfor %}

  203. {% endif %}

  204. 

  205. {% if 'ssh_auth.absent' in user %}

  206. {% for auth in user['ssh_auth.absent'] %}

  207. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  208.   ssh_auth.absent:

  209.     - user: {{ name }}

  210.     - name: {{ auth }}

  211.     - require:

  212.         - file: users_{{ name }}_user

  213.         - user: users_{{ name }}_user

  214. {% endfor %}

  215. {% endif %}

  216. 

  217. {% if 'ssh_config' in user %}

  218. users_ssh_config_{{ name }}:

  219.   file.managed:

  220.     - name: {{ home }}/.ssh/config

  221.     - user: {{ name }}

  222.     - group: {{ user_group }}

  223.     - mode: 640

  224.     - contents: |

  225.         # Managed by Saltstack

  226.         # Do Not Edit

  227.         {% for label, setting in user.ssh_config.items() %}

  228.         # {{ label }}

  229.         Host {{ setting.get('hostname') }}

  230.           {%- for opts in setting.get('options') %}

  231.           {{ opts }}

  232.           {%- endfor %}

  233.         {% endfor -%}

  234. {% endif %}

  235. 

  236. {% if 'sudouser' in user and user['sudouser'] %}

  237. 

  238. users_sudoer-{{ name }}:

  239.   file.managed:

  240.     - name: {{ users.sudoers_dir }}/{{ name }}

  241.     - user: root

  242.     - group: {{ users.root_group }}

  243.     - mode: '0440'

  244. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  245. {% if 'sudo_rules' in user %}

  246. {% for rule in user['sudo_rules'] %}

  247. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  248.   cmd.run:

  249.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  250.     - stateful: True

  251.     - shell: {{ users.visudo_shell }}

  252.     - env:

  253.       # Specify the rule via an env var to avoid shell quoting issues.

  254.       - rule: "{{ name }} {{ rule }}"

  255.     - require_in:

  256.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  257. {% endfor %}

  258. {% endif %}

  259. {% if 'sudo_defaults' in user %}

  260. {% for entry in user['sudo_defaults'] %}

  261. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  262.   cmd.run:

  263.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  264.     - stateful: True

  265.     - shell: {{ users.visudo_shell }}

  266.     - env:

  267.       # Specify the rule via an env var to avoid shell quoting issues.

  268.       - rule: "Defaults:{{ name }} {{ entry }}"

  269.     - require_in:

  270.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  271. {% endfor %}

  272. {% endif %}

  273. 

  274. users_{{ users.sudoers_dir }}/{{ name }}:

  275.   file.managed:

  276.     - name: {{ users.sudoers_dir }}/{{ name }}

  277.     - contents: |

  278.       {%- if 'sudo_defaults' in user %}

  279.       {%- for entry in user['sudo_defaults'] %}

  280.         Defaults:{{ name }} {{ entry }}

  281.       {%- endfor %}

  282.       {%- endif %}

  283.       {%- if 'sudo_rules' in user %}

  284.       {%- for rule in user['sudo_rules'] %}

  285.         {{ name }} {{ rule }}

  286.       {%- endfor %}

  287.       {%- endif %}

  288.     - require:

  289.       - file: users_sudoer-defaults

  290.       - file: users_sudoer-{{ name }}

  291. {% endif %}

  292. {% else %}

  293. users_{{ users.sudoers_dir }}/{{ name }}:

  294.   file.absent:

  295.     - name: {{ users.sudoers_dir }}/{{ name }}

  296. {% endif %}

  297. 

  298. {%- if 'google_auth' in user %}

  299. {%- for svc in user['google_auth'] %}

  300. users_googleauth-{{ svc }}-{{ name }}:

  301.   file.managed:

  302.     - replace: false

  303.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  304.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  305.     - user: root

  306.     - group: {{ users.root_group }}

  307.     - mode: 400

  308.     - require:

  309.       - pkg: users_googleauth-package

  310. {%- endfor %}

  311. {%- endif %}

  312. 

  313. {% endfor %}

  314. 

  315. 

  316. {% for name, user in pillar.get('users', {}).iteritems() if user.absent is defined and user.absent %}

  317. users_absent_user_{{ name }}:

  318. {% if 'purge' in user or 'force' in user %}

  319.   user.absent:

  320.     - name: {{ name }}

  321.     {% if 'purge' in user %}

  322.     - purge: {{ user['purge'] }}

  323.     {% endif %}

  324.     {% if 'force' in user %}

  325.     - force: {{ user['force'] }}

  326.     {% endif %}

  327. {% else %}

  328.   user.absent:

  329.     - name: {{ name }}

  330. {% endif -%}

  331. users_{{ users.sudoers_dir }}/{{ name }}:

  332.   file.absent:

  333.     - name: {{ users.sudoers_dir }}/{{ name }}

  334. {% endfor %}

  335. 

  336. {% for user in pillar.get('absent_users', []) %}

  337. users_absent_user_2_{{ user }}:

  338.   user.absent

  339. users_2_{{ users.sudoers_dir }}/{{ user }}:

  340.   file.absent:

  341.     - name: {{ users.sudoers_dir }}/{{ user }}

  342. {% endfor %}

  343. 

  344. {% for group in pillar.get('absent_groups', []) %}

  345. users_absent_group_{{ group }}:

  346.   group.absent:

  347.     - name: {{ group }}

  348. {% endfor %}