salt
/
users-formula
bifurqué depuis ExternalMirrors/users-formula
Suivre 1
Ajouter aux favoris 0
Bifurcation 0
Code Versions 0 Activité
Saltstack Official Users Formula
Vous ne pouvez pas sélectionner plus de 25 sujets Les noms de sujets doivent commencer par une lettre ou un nombre, peuvent contenir des tirets ('-') et peuvent comporter jusqu'à 35 caractères.
210 Révisions
2 Branches
Aborescence: 83ab48c316
Branches Tags
${ item.name }
Créer la branche ${ searchTerm }
de '83ab48c316'
${ noResults }
users-formula/users/init.sls

484 lines
14KB
Brut Annotations Historique 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. 

  7. {%- for name, user in pillar.get('users', {}).items()

  8.         if user.absent is not defined or not user.absent %}

  9. {%- if user == None -%}

  10. {%- set user = {} -%}

  11. {%- endif -%}

  12. {%- if 'sudouser' in user and user['sudouser'] %}

  13. {%- do used_sudo.append(1) %}

  14. {%- endif %}

  15. {%- if 'google_auth' in user %}

  16. {%- do used_googleauth.append(1) %}

  17. {%- endif %}

  18. {%- if salt['pillar.get']('users:' ~ name ~ ':user_files:enabled', False) %}

  19. {%- do used_user_files.append(1) %}

  20. {%- endif %}

  21. {%- endfor %}

  22. 

  23. {%- if used_sudo or used_googleauth or used_user_files %}

  24. include:

  25. {%- if used_sudo %}

  26.   - users.sudo

  27. {%- endif %}

  28. {%- if used_googleauth %}

  29.   - users.googleauth

  30. {%- endif %}

  31. {%- if used_user_files %}

  32.   - users.user_files

  33. {%- endif %}

  34. {%- endif %}

  35. 

  36. {% for name, user in pillar.get('users', {}).items()

  37.         if user.absent is not defined or not user.absent %}

  38. {%- if user == None -%}

  39. {%- set user = {} -%}

  40. {%- endif -%}

  41. {%- set current = salt.user.info(name) -%}

  42. {%- set home = user.get('home', current.get('home', "/home/%s" % name)) -%}

  43. 

  44. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  45. {%- set user_group = user.prime_group.name -%}

  46. {%- else -%}

  47. {%- set user_group = name -%}

  48. {%- endif %}

  49. 

  50. {% for group in user.get('groups', []) %}

  51. users_{{ name }}_{{ group }}_group:

  52.   group.present:

  53.     - name: {{ group }}

  54.     {% if group == 'sudo' %}

  55.     - system: True

  56.     {% endif %}

  57. {% endfor %}

  58. 

  59. users_{{ name }}_user:

  60.   {% if user.get('createhome', True) %}

  61.   file.directory:

  62.     - name: {{ home }}

  63.     - user: {{ name }}

  64.     - group: {{ user_group }}

  65.     - mode: {{ user.get('user_dir_mode', '0750') }}

  66.     - require:

  67.       - user: users_{{ name }}_user

  68.       - group: {{ user_group }}

  69.   {%- endif %}

  70.   group.present:

  71.     - name: {{ user_group }}

  72.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  73.     - gid: {{ user['prime_group']['gid'] }}

  74.     {%- elif 'uid' in user %}

  75.     - gid: {{ user['uid'] }}

  76.     {%- endif %}

  77.     {% if 'system' in user and user['system'] %}

  78.     - system: True

  79.     {% endif %}

  80.   user.present:

  81.     - name: {{ name }}

  82.     - home: {{ home }}

  83.     - shell: {{ user.get('shell', current.get('shell', users.get('shell', '/bin/bash'))) }}

  84.     {% if 'uid' in user -%}

  85.     - uid: {{ user['uid'] }}

  86.     {% endif -%}

  87.     {% if 'password' in user -%}

  88.     - password: '{{ user['password'] }}'

  89.     {% endif -%}

  90.     {% if user.get('empty_password') -%}

  91.     - empty_password: {{ user.get('empty_password') }}

  92.     {% endif -%}

  93.     {% if 'enforce_password' in user -%}

  94.     - enforce_password: {{ user['enforce_password'] }}

  95.     {% endif -%}

  96.     {% if user.get('system', False) -%}

  97.     - system: True

  98.     {% endif -%}

  99.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  100.     - gid: {{ user['prime_group']['gid'] }}

  101.     {% else -%}

  102.     - gid_from_name: True

  103.     {% endif -%}

  104.     {% if 'fullname' in user %}

  105.     - fullname: {{ user['fullname'] }}

  106.     {% endif -%}

  107.     {% if 'roomnumber' in user %}

  108.     - roomnumber: {{ user['roomnumber'] }}

  109.     {% endif %}

  110.     {% if 'workphone' in user %}

  111.     - workphone: {{ user['workphone'] }}

  112.     {% endif %}

  113.     {% if 'homephone' in user %}

  114.     - homephone: {{ user['workphone'] }}

  115.     {% endif %}

  116.     {% if not user.get('createhome', True) %}

  117.     - createhome: False

  118.     {% endif %}

  119.     {% if 'expire' in user -%}

  120.         {% if grains['kernel'].endswith('BSD') and

  121.             user['expire'] < 157766400 %}

  122.         {# 157762800s since epoch equals 01 Jan 1975 00:00:00 UTC #}

  123.     - expire: {{ user['expire'] * 86400 }}

  124.         {% elif grains['kernel'] == 'Linux' and

  125.             user['expire'] > 84006 %}

  126.         {# 2932896 days since epoch equals 9999-12-31 #}

  127.     - expire: {{ (user['expire'] / 86400) | int}}

  128.         {% else %}

  129.     - expire: {{ user['expire'] }}

  130.         {% endif %}

  131.     {% endif -%}

  132.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  133.     - groups:

  134.       - {{ user_group }}

  135.       {% for group in user.get('groups', []) -%}

  136.       - {{ group }}

  137.       {% endfor %}

  138.     - require:

  139.       - group: {{ user_group }}

  140.       {% for group in user.get('groups', []) -%}

  141.       - group: {{ group }}

  142.       {% endfor %}

  143. 

  144. 

  145.   {% if 'ssh_keys' in user or

  146.       'ssh_auth' in user or

  147.       'ssh_auth_file' in user or

  148.       'ssh_auth_pillar' in user or

  149.       'ssh_auth.absent' in user or

  150.       'ssh_config' in user %}

  151. user_keydir_{{ name }}:

  152.   file.directory:

  153.     - name: {{ home }}/.ssh

  154.     - user: {{ name }}

  155.     - group: {{ user_group }}

  156.     - makedirs: True

  157.     - mode: 700

  158.     - require:

  159.       - user: {{ name }}

  160.       - group: {{ user_group }}

  161.       {%- for group in user.get('groups', []) %}

  162.       - group: {{ group }}

  163.       {%- endfor %}

  164.   {% endif %}

  165. 

  166.   {% if 'ssh_keys' in user %}

  167.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  168. users_user_{{ name }}_private_key:

  169.   file.managed:

  170.     - name: {{ home }}/.ssh/{{ key_type }}

  171.     - user: {{ name }}

  172.     - group: {{ user_group }}

  173.     - mode: 600

  174.     - show_diff: False

  175.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  176.     - require:

  177.       - user: users_{{ name }}_user

  178.       {% for group in user.get('groups', []) %}

  179.       - group: users_{{ name }}_{{ group }}_group

  180.       {% endfor %}

  181. users_user_{{ name }}_public_key:

  182.   file.managed:

  183.     - name: {{ home }}/.ssh/{{ key_type }}.pub

  184.     - user: {{ name }}

  185.     - group: {{ user_group }}

  186.     - mode: 644

  187.     - show_diff: False

  188.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  189.     - require:

  190.       - user: users_{{ name }}_user

  191.       {% for group in user.get('groups', []) %}

  192.       - group: users_{{ name }}_{{ group }}_group

  193.       {% endfor %}

  194.   {% endif %}

  195. 

  196. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  197. users_authorized_keys_{{ name }}:

  198.   file.managed:

  199.     - name: {{ home }}/.ssh/authorized_keys

  200.     - user: {{ name }}

  201.     - group: {{ user_group }}

  202.     - mode: 600

  203. {% if 'ssh_auth_file' in user %}

  204.     - contents: |

  205.         {% for auth in user.ssh_auth_file -%}

  206.         {{ auth }}

  207.         {% endfor -%}

  208. {% else %}

  209.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].items() %}

  210.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  211.         {%- endfor %}

  212. {% endif %}

  213. {% endif %}

  214. 

  215. {% if 'ssh_auth' in user %}

  216. {% for auth in user['ssh_auth'] %}

  217. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  218.   ssh_auth.present:

  219.     - user: {{ name }}

  220.     - name: {{ auth }}

  221.     - require:

  222.         - file: user_keydir_{{ name }}

  223.         - user: users_{{ name }}_user

  224. {% endfor %}

  225. {% endif %}

  226. 

  227. {% if 'ssh_keys_pillar' in user %}

  228. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  229. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  230.   file.managed:

  231.     - name: {{ home }}/.ssh/{{ key_name }}

  232.     - user: {{ name }}

  233.     - group: {{ user_group }}

  234.     - mode: 600

  235.     - show_diff: False

  236.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  237.     - require:

  238.       - user: users_{{ name }}_user

  239.       {% for group in user.get('groups', []) %}

  240.       - group: users_{{ name }}_{{ group }}_group

  241.       {% endfor %}

  242. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  243.   file.managed:

  244.     - name: {{ home }}/.ssh/{{ key_name }}.pub

  245.     - user: {{ name }}

  246.     - group: {{ user_group }}

  247.     - mode: 644

  248.     - show_diff: False

  249.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  250.     - require:

  251.       - user: users_{{ name }}_user

  252.       {% for group in user.get('groups', []) %}

  253.       - group: users_{{ name }}_{{ group }}_group

  254.       {% endfor %}

  255. {% endfor %}

  256. {% endif %}

  257. 

  258. {% if 'ssh_auth_sources' in user %}

  259. {% for pubkey_file in user['ssh_auth_sources'] %}

  260. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  261.   ssh_auth.present:

  262.     - user: {{ name }}

  263.     - source: {{ pubkey_file }}

  264.     - require:

  265.         - file: users_{{ name }}_user

  266.         - user: users_{{ name }}_user

  267. {% endfor %}

  268. {% endif %}

  269. 

  270. {% if 'ssh_auth.absent' in user %}

  271. {% for auth in user['ssh_auth.absent'] %}

  272. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  273.   ssh_auth.absent:

  274.     - user: {{ name }}

  275.     - name: {{ auth }}

  276.     - require:

  277.         - file: users_{{ name }}_user

  278.         - user: users_{{ name }}_user

  279. {% endfor %}

  280. {% endif %}

  281. 

  282. {% if 'ssh_config' in user %}

  283. users_ssh_config_{{ name }}:

  284.   file.managed:

  285.     - name: {{ home }}/.ssh/config

  286.     - user: {{ name }}

  287.     - group: {{ user_group }}

  288.     - mode: 640

  289.     - contents: |

  290.         # Managed by Saltstack

  291.         # Do Not Edit

  292.         {% for label, setting in user.ssh_config.items() %}

  293.         # {{ label }}

  294.         Host {{ setting.get('hostname') }}

  295.           {%- for opts in setting.get('options') %}

  296.           {{ opts }}

  297.           {%- endfor %}

  298.         {% endfor -%}

  299. {% endif %}

  300. 

  301. {% if 'ssh_known_hosts' in user %}

  302. {% for hostname, host in user['ssh_known_hosts'].items() %}

  303. users_ssh_known_hosts_{{ name }}_{{ loop.index0 }}:

  304.   ssh_known_hosts.present:

  305.     - user: {{ name }}

  306.     - name: {{ hostname }}

  307.     {% if 'port' in host %}

  308.     - port: {{ host['port'] }}

  309.     {% endif -%}

  310.     {% if 'fingerprint' in host %}

  311.     - fingerprint: {{ host['fingerprint'] }}

  312.     {% endif -%}

  313.     {% if 'key' in host %}

  314.     - key: {{ host['key'] }}

  315.     {% endif -%}

  316.     {% if 'enc' in host %}

  317.     - enc: {{ host['enc'] }}

  318.     {% endif -%}

  319.     {% if 'hash_hostname' in host %}

  320.     - hash_hostname: {{ host['hash_hostname'] }}

  321.     {% endif -%}

  322. {% endfor %}

  323. {% endif %}

  324. 

  325. {% if 'ssh_known_hosts.absent' in user %}

  326. {% for host in user['ssh_known_hosts.absent'] %}

  327. users_ssh_known_hosts_delete_{{ name }}_{{ loop.index0 }}:

  328.   ssh_known_hosts.absent:

  329.     - user: {{ name }}

  330.     - name: {{ host }}

  331. {% endfor %}

  332. {% endif %}

  333. 

  334. {% if 'sudouser' in user and user['sudouser'] %}

  335. 

  336. users_sudoer-{{ name }}:

  337.   file.managed:

  338.     - name: {{ users.sudoers_dir }}/{{ name }}

  339.     - user: root

  340.     - group: {{ users.root_group }}

  341.     - mode: '0440'

  342. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  343. #{#%

  344. {% if 'sudo_rules' in user %}

  345. {% for rule in user['sudo_rules'] %}

  346. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  347.   cmd.run:

  348.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  349.     - stateful: True

  350.     - shell: {{ users.visudo_shell }}

  351.     - env:

  352.       # Specify the rule via an env var to avoid shell quoting issues.

  353.       - rule: "{{ name }} {{ rule }}"

  354.     - require_in:

  355.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  356. {% endfor %}

  357. {% endif %}

  358. {% if 'sudo_defaults' in user %}

  359. {% for entry in user['sudo_defaults'] %}

  360. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  361.   cmd.run:

  362.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  363.     - stateful: True

  364.     - shell: {{ users.visudo_shell }}

  365.     - env:

  366.       # Specify the rule via an env var to avoid shell quoting issues.

  367.       - rule: "Defaults:{{ name }} {{ entry }}"

  368.     - require_in:

  369.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  370. {% endfor %}

  371. {% endif %}

  372. #%#}

  373. 

  374. users_{{ users.sudoers_dir }}/{{ name }}:

  375.   file.managed:

  376.     - name: {{ users.sudoers_dir }}/{{ name }}

  377.     - contents: |

  378.       {%- if 'sudo_defaults' in user %}

  379.       {%- for entry in user['sudo_defaults'] %}

  380.         Defaults:{{ name }} {{ entry }}

  381.       {%- endfor %}

  382.       {%- endif %}

  383.       {%- if 'sudo_rules' in user %}

  384.         ########################################################################

  385.         # File managed by Salt (users-formula).

  386.         # Your changes will be overwritten.

  387.         ########################################################################

  388.         #

  389.       {%- for rule in user['sudo_rules'] %}

  390.         {{ name }} {{ rule }}

  391.       {%- endfor %}

  392.       {%- endif %}

  393.     - require:

  394.       - file: users_sudoer-defaults

  395.       - file: users_sudoer-{{ name }}

  396.   cmd.wait:

  397.     - name: visudo -cf {{ users.sudoers_dir }}/{{ name }} || ( rm -rvf {{ users.sudoers_dir }}/{{ name }}; exit 1 )

  398.     - watch:

  399.       - file: {{ users.sudoers_dir }}/{{ name }}

  400. {% endif %}

  401. {% else %}

  402. users_{{ users.sudoers_dir }}/{{ name }}:

  403.   file.absent:

  404.     - name: {{ users.sudoers_dir }}/{{ name }}

  405. {% endif %}

  406. 

  407. {%- if 'google_auth' in user %}

  408. {%- for svc in user['google_auth'] %}

  409. users_googleauth-{{ svc }}-{{ name }}:

  410.   file.managed:

  411.     - replace: false

  412.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  413.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  414.     - user: root

  415.     - group: {{ users.root_group }}

  416.     - mode: 400

  417.     - require:

  418.       - pkg: users_googleauth-package

  419. {%- endfor %}

  420. {%- endif %}

  421. 

  422. {% if 'gitconfig' in user %}

  423. {% if not salt['cmd.has_exec']('git') %}

  424. skip_{{ name }}_gitconfig_since_git_not_installed:

  425.   test.fail_without_changes:

  426.     - name: "Git configuration for user {{ name }} has been skipped because Git is not installed."

  427. {% else %}

  428. {% for key, value in user['gitconfig'].items() %}

  429. users_{{ name }}_user_gitconfig_{{ loop.index0 }}:

  430.   {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  431.   git.config_set:

  432.   {% else %}

  433.   git.config:

  434.   {% endif %}

  435.     - name: {{ key }}

  436.     - value: "{{ value }}"

  437.     - user: {{ name }}

  438.     {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  439.     - global: True

  440.     {% else %}

  441.     - is_global: True

  442.     {% endif %}

  443. {% endfor %}

  444. {% endif %}

  445. {% endif %}

  446. 

  447. {% endfor %}

  448. 

  449. 

  450. {% for name, user in pillar.get('users', {}).items()

  451.         if user.absent is defined and user.absent %}

  452. users_absent_user_{{ name }}:

  453. {% if 'purge' in user or 'force' in user %}

  454.   user.absent:

  455.     - name: {{ name }}

  456.     {% if 'purge' in user %}

  457.     - purge: {{ user['purge'] }}

  458.     {% endif %}

  459.     {% if 'force' in user %}

  460.     - force: {{ user['force'] }}

  461.     {% endif %}

  462. {% else %}

  463.   user.absent:

  464.     - name: {{ name }}

  465. {% endif -%}

  466. users_{{ users.sudoers_dir }}/{{ name }}:

  467.   file.absent:

  468.     - name: {{ users.sudoers_dir }}/{{ name }}

  469. {% endfor %}

  470. 

  471. {% for user in pillar.get('absent_users', []) %}

  472. users_absent_user_2_{{ user }}:

  473.   user.absent

  474. users_2_{{ users.sudoers_dir }}/{{ user }}:

  475.   file.absent:

  476.     - name: {{ users.sudoers_dir }}/{{ user }}

  477. {% endfor %}

  478. 

  479. {% for group in pillar.get('absent_groups', []) %}

  480. users_absent_group_{{ group }}:

  481.   group.absent:

  482.     - name: {{ group }}

  483. {% endfor %}