salt
/
users-formula
geforked van ExternalMirrors/users-formula
Volgen 1
Ster 0
Vork 0
Code Publicaties 0 Activiteit
Saltstack Official Users Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
157 Commits
2 Branches
Tree: 9629cfe348
Branches Labels
${ item.name }
Maak branch ${ searchTerm }
van '9629cfe348'
${ noResults }
users-formula/users/init.sls

384 lines
11KB
Ruw Blame Geschiedenis 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. 

  6. {%- for name, user in pillar.get('users', {}).items()

  7.         if user.absent is not defined or not user.absent %}

  8. {%- if user == None -%}

  9. {%- set user = {} -%}

  10. {%- endif -%}

  11. {%- if 'sudouser' in user and user['sudouser'] %}

  12. {%- do used_sudo.append(1) %}

  13. {%- endif %}

  14. {%- if 'google_auth' in user %}

  15. {%- do used_googleauth.append(1) %}

  16. {%- endif %}

  17. {%- endfor %}

  18. 

  19. {%- if used_sudo or used_googleauth %}

  20. include:

  21. {%- if used_sudo %}

  22.   - users.sudo

  23. {%- endif %}

  24. {%- if used_googleauth %}

  25.   - users.googleauth

  26. {%- endif %}

  27. {%- endif %}

  28. 

  29. {% for name, user in pillar.get('users', {}).items()

  30.         if user.absent is not defined or not user.absent %}

  31. {%- if user == None -%}

  32. {%- set user = {} -%}

  33. {%- endif -%}

  34. {%- set home = user.get('home', "/home/%s" % name) -%}

  35. 

  36. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  37. {%- set user_group = user.prime_group.name -%}

  38. {%- else -%}

  39. {%- set user_group = name -%}

  40. {%- endif %}

  41. 

  42. {% for group in user.get('groups', []) %}

  43. users_{{ name }}_{{ group }}_group:

  44.   group:

  45.     - name: {{ group }}

  46.     - present

  47. {% endfor %}

  48. 

  49. users_{{ name }}_user:

  50.   {% if user.get('createhome', True) %}

  51.   file.directory:

  52.     - name: {{ home }}

  53.     - user: {{ name }}

  54.     - group: {{ user_group }}

  55.     - mode: {{ user.get('user_dir_mode', '0750') }}

  56.     - require:

  57.       - user: users_{{ name }}_user

  58.       - group: {{ user_group }}

  59.   {%- endif %}

  60.   group.present:

  61.     - name: {{ user_group }}

  62.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  63.     - gid: {{ user['prime_group']['gid'] }}

  64.     {%- elif 'uid' in user %}

  65.     - gid: {{ user['uid'] }}

  66.     {%- endif %}

  67.   user.present:

  68.     - name: {{ name }}

  69.     - home: {{ home }}

  70.     - shell: {{ user.get('shell', users.get('shell', '/bin/bash')) }}

  71.     {% if 'uid' in user -%}

  72.     - uid: {{ user['uid'] }}

  73.     {% endif -%}

  74.     {% if 'password' in user -%}

  75.     - password: '{{ user['password'] }}'

  76.     {% endif -%}

  77.     {% if 'enforce_password' in user -%}

  78.     - enforce_password: {{ user['enforce_password'] }}

  79.     {% endif -%}

  80.     {% if user.get('system', False) -%}

  81.     - system: True

  82.     {% endif -%}

  83.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  84.     - gid: {{ user['prime_group']['gid'] }}

  85.     {% else -%}

  86.     - gid_from_name: True

  87.     {% endif -%}

  88.     {% if 'fullname' in user %}

  89.     - fullname: {{ user['fullname'] }}

  90.     {% endif -%}

  91.     {% if not user.get('createhome', True) %}

  92.     - createhome: False

  93.     {% endif %}

  94.     {% if 'expire' in user -%}

  95.     - expire: {{ user['expire'] }}

  96.     {% endif -%}

  97.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  98.     - groups:

  99.       - {{ user_group }}

  100.       {% for group in user.get('groups', []) -%}

  101.       - {{ group }}

  102.       {% endfor %}

  103.     - require:

  104.       - group: {{ user_group }}

  105.       {% for group in user.get('groups', []) -%}

  106.       - group: {{ group }}

  107.       {% endfor %}

  108. 

  109. 

  110.   {% if 'ssh_keys' in user or

  111.       'ssh_auth' in user or

  112.       'ssh_auth_file' in user or

  113.       'ssh_auth.absent' in user or

  114.       'ssh_config' in user %}

  115. user_keydir_{{ name }}:

  116.   file.directory:

  117.     - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh

  118.     - user: {{ name }}

  119.     - group: {{ user_group }}

  120.     - makedirs: True

  121.     - mode: 700

  122.     - require:

  123.       - user: {{ name }}

  124.       - group: {{ user_group }}

  125.       {%- for group in user.get('groups', []) %}

  126.       - group: {{ group }}

  127.       {%- endfor %}

  128.   {% endif %}

  129. 

  130.   {% if 'ssh_keys' in user %}

  131.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  132. users_user_{{ name }}_private_key:

  133.   file.managed:

  134.     - name: {{ user.get('home',

  135.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}

  136.     - user: {{ name }}

  137.     - group: {{ user_group }}

  138.     - mode: 600

  139.     - show_diff: False

  140.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  141.     - require:

  142.       - user: users_{{ name }}_user

  143.       {% for group in user.get('groups', []) %}

  144.       - group: users_{{ name }}_{{ group }}_group

  145.       {% endfor %}

  146. users_user_{{ name }}_public_key:

  147.   file.managed:

  148.     - name: {{ user.get('home',

  149.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}.pub

  150.     - user: {{ name }}

  151.     - group: {{ user_group }}

  152.     - mode: 644

  153.     - show_diff: False

  154.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  155.     - require:

  156.       - user: users_{{ name }}_user

  157.       {% for group in user.get('groups', []) %}

  158.       - group: users_{{ name }}_{{ group }}_group

  159.       {% endfor %}

  160.   {% endif %}

  161. 

  162. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  163. users_authorized_keys_{{ name }}:

  164.   file.managed:

  165.     - name: {{ home }}/.ssh/authorized_keys

  166.     - user: {{ name }}

  167.     - group: {{ name }}

  168.     - mode: 600

  169. {% if 'ssh_auth_file' in user %}

  170.     - contents: |

  171.         {% for auth in user.ssh_auth_file -%}

  172.         {{ auth }}

  173.         {% endfor -%}

  174. {% else %}

  175.     - contents: |

  176.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].iteritems() %}

  177.         {{ salt['pillar.get'](pillar_name + ':' + key_name + ':pubkey', '') }}

  178.         {%- endfor %}

  179. {% endif %}

  180. {% endif %}

  181. 

  182. {% if 'ssh_auth' in user %}

  183. {% for auth in user['ssh_auth'] %}

  184. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  185.   ssh_auth.present:

  186.     - user: {{ name }}

  187.     - name: {{ auth }}

  188.     - require:

  189.         - file: users_{{ name }}_user

  190.         - user: users_{{ name }}_user

  191. {% endfor %}

  192. {% endif %}

  193. 

  194. {% if 'ssh_keys_pillar' in user %}

  195. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  196. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  197.   file.managed:

  198.     - name: {{ user.get('home',

  199.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}

  200.     - user: {{ name }}

  201.     - group: {{ user_group }}

  202.     - mode: 600

  203.     - show_diff: False

  204.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  205.     - require:

  206.       - user: users_{{ name }}_user

  207.       {% for group in user.get('groups', []) %}

  208.       - group: users_{{ name }}_{{ group }}_group

  209.       {% endfor %}

  210. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  211.   file.managed:

  212.     - name: {{ user.get('home',

  213.                   '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}.pub

  214.     - user: {{ name }}

  215.     - group: {{ user_group }}

  216.     - mode: 644

  217.     - show_diff: False

  218.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  219.     - require:

  220.       - user: users_{{ name }}_user

  221.       {% for group in user.get('groups', []) %}

  222.       - group: users_{{ name }}_{{ group }}_group

  223.       {% endfor %}

  224. {% endfor %}

  225. {% endif %}

  226. 

  227. {% if 'ssh_auth_sources' in user %}

  228. {% for pubkey_file in user['ssh_auth_sources'] %}

  229. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  230.   ssh_auth.present:

  231.     - user: {{ name }}

  232.     - source: {{ pubkey_file }}

  233.     - require:

  234.         - file: users_{{ name }}_user

  235.         - user: users_{{ name }}_user

  236. {% endfor %}

  237. {% endif %}

  238. 

  239. {% if 'ssh_auth.absent' in user %}

  240. {% for auth in user['ssh_auth.absent'] %}

  241. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  242.   ssh_auth.absent:

  243.     - user: {{ name }}

  244.     - name: {{ auth }}

  245.     - require:

  246.         - file: users_{{ name }}_user

  247.         - user: users_{{ name }}_user

  248. {% endfor %}

  249. {% endif %}

  250. 

  251. {% if 'ssh_config' in user %}

  252. users_ssh_config_{{ name }}:

  253.   file.managed:

  254.     - name: {{ home }}/.ssh/config

  255.     - user: {{ name }}

  256.     - group: {{ user_group }}

  257.     - mode: 640

  258.     - contents: |

  259.         # Managed by Saltstack

  260.         # Do Not Edit

  261.         {% for label, setting in user.ssh_config.items() %}

  262.         # {{ label }}

  263.         Host {{ setting.get('hostname') }}

  264.           {%- for opts in setting.get('options') %}

  265.           {{ opts }}

  266.           {%- endfor %}

  267.         {% endfor -%}

  268. {% endif %}

  269. 

  270. {% if 'sudouser' in user and user['sudouser'] %}

  271. 

  272. users_sudoer-{{ name }}:

  273.   file.managed:

  274.     - name: {{ users.sudoers_dir }}/{{ name }}

  275.     - user: root

  276.     - group: {{ users.root_group }}

  277.     - mode: '0440'

  278. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  279. {% if 'sudo_rules' in user %}

  280. {% for rule in user['sudo_rules'] %}

  281. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  282.   cmd.run:

  283.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  284.     - stateful: True

  285.     - shell: {{ users.visudo_shell }}

  286.     - env:

  287.       # Specify the rule via an env var to avoid shell quoting issues.

  288.       - rule: "{{ name }} {{ rule }}"

  289.     - require_in:

  290.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  291. {% endfor %}

  292. {% endif %}

  293. {% if 'sudo_defaults' in user %}

  294. {% for entry in user['sudo_defaults'] %}

  295. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  296.   cmd.run:

  297.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  298.     - stateful: True

  299.     - shell: {{ users.visudo_shell }}

  300.     - env:

  301.       # Specify the rule via an env var to avoid shell quoting issues.

  302.       - rule: "Defaults:{{ name }} {{ entry }}"

  303.     - require_in:

  304.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  305. {% endfor %}

  306. {% endif %}

  307. 

  308. users_{{ users.sudoers_dir }}/{{ name }}:

  309.   file.managed:

  310.     - name: {{ users.sudoers_dir }}/{{ name }}

  311.     - contents: |

  312.       {%- if 'sudo_defaults' in user %}

  313.       {%- for entry in user['sudo_defaults'] %}

  314.         Defaults:{{ name }} {{ entry }}

  315.       {%- endfor %}

  316.       {%- endif %}

  317.       {%- if 'sudo_rules' in user %}

  318.       {%- for rule in user['sudo_rules'] %}

  319.         {{ name }} {{ rule }}

  320.       {%- endfor %}

  321.       {%- endif %}

  322.     - require:

  323.       - file: users_sudoer-defaults

  324.       - file: users_sudoer-{{ name }}

  325. {% endif %}

  326. {% else %}

  327. users_{{ users.sudoers_dir }}/{{ name }}:

  328.   file.absent:

  329.     - name: {{ users.sudoers_dir }}/{{ name }}

  330. {% endif %}

  331. 

  332. {%- if 'google_auth' in user %}

  333. {%- for svc in user['google_auth'] %}

  334. users_googleauth-{{ svc }}-{{ name }}:

  335.   file.managed:

  336.     - replace: false

  337.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  338.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  339.     - user: root

  340.     - group: {{ users.root_group }}

  341.     - mode: 400

  342.     - require:

  343.       - pkg: users_googleauth-package

  344. {%- endfor %}

  345. {%- endif %}

  346. 

  347. {% endfor %}

  348. 

  349. 

  350. {% for name, user in pillar.get('users', {}).items()

  351.         if user.absent is defined and user.absent %}

  352. users_absent_user_{{ name }}:

  353. {% if 'purge' in user or 'force' in user %}

  354.   user.absent:

  355.     - name: {{ name }}

  356.     {% if 'purge' in user %}

  357.     - purge: {{ user['purge'] }}

  358.     {% endif %}

  359.     {% if 'force' in user %}

  360.     - force: {{ user['force'] }}

  361.     {% endif %}

  362. {% else %}

  363.   user.absent:

  364.     - name: {{ name }}

  365. {% endif -%}

  366. users_{{ users.sudoers_dir }}/{{ name }}:

  367.   file.absent:

  368.     - name: {{ users.sudoers_dir }}/{{ name }}

  369. {% endfor %}

  370. 

  371. {% for user in pillar.get('absent_users', []) %}

  372. users_absent_user_2_{{ user }}:

  373.   user.absent

  374. users_2_{{ users.sudoers_dir }}/{{ user }}:

  375.   file.absent:

  376.     - name: {{ users.sudoers_dir }}/{{ user }}

  377. {% endfor %}

  378. 

  379. {% for group in pillar.get('absent_groups', []) %}

  380. users_absent_group_{{ group }}:

  381.   group.absent:

  382.     - name: {{ group }}

  383. {% endfor %}