salt
/
users-formula
forked from ExternalMirrors/users-formula
Watch 1
Star 0
Fork 0
Code Releases 0 Activity
Saltstack Official Users Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
231 Commits
2 Branches
Tree: b873db1aee
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'b873db1aee'
${ noResults }
users-formula/users/init.sls

503 lines
14KB
Raw Blame History 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. 

  7. {%- for name, user in pillar.get('users', {}).items()

  8.         if user.absent is not defined or not user.absent %}

  9. {%- if user == None -%}

  10. {%- set user = {} -%}

  11. {%- endif -%}

  12. {%- if 'sudouser' in user and user['sudouser'] %}

  13. {%- do used_sudo.append(1) %}

  14. {%- endif %}

  15. {%- if 'google_auth' in user %}

  16. {%- do used_googleauth.append(1) %}

  17. {%- endif %}

  18. {%- if salt['pillar.get']('users:' ~ name ~ ':user_files:enabled', False) %}

  19. {%- do used_user_files.append(1) %}

  20. {%- endif %}

  21. {%- endfor %}

  22. 

  23. {%- if used_sudo or used_googleauth or used_user_files %}

  24. include:

  25. {%- if used_sudo %}

  26.   - users.sudo

  27. {%- endif %}

  28. {%- if used_googleauth %}

  29.   - users.googleauth

  30. {%- endif %}

  31. {%- if used_user_files %}

  32.   - users.user_files

  33. {%- endif %}

  34. {%- endif %}

  35. 

  36. {% for name, user in pillar.get('users', {}).items()

  37.         if user.absent is not defined or not user.absent %}

  38. {%- if user == None -%}

  39. {%- set user = {} -%}

  40. {%- endif -%}

  41. {%- set current = salt.user.info(name) -%}

  42. {%- set home = user.get('home', current.get('home', "/home/%s" % name)) -%}

  43. 

  44. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  45. {%- set user_group = user.prime_group.name -%}

  46. {%- else -%}

  47. {%- set user_group = name -%}

  48. {%- endif %}

  49. 

  50. {% for group in user.get('groups', []) %}

  51. users_{{ name }}_{{ group }}_group:

  52.   group.present:

  53.     - name: {{ group }}

  54.     {% if group == 'sudo' %}

  55.     - system: True

  56.     {% endif %}

  57. {% endfor %}

  58. 

  59. users_{{ name }}_user:

  60.   {% if user.get('createhome', True) %}

  61.   file.directory:

  62.     - name: {{ home }}

  63.     - user: {{ user.get('homedir_owner', name) }}

  64.     - group: {{ user.get('homedir_group', user_group) }}

  65.     - mode: {{ user.get('user_dir_mode', '0750') }}

  66.     - require:

  67.       - user: users_{{ name }}_user

  68.       - group: {{ user_group }}

  69.   {%- endif %}

  70.   group.present:

  71.     - name: {{ user_group }}

  72.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  73.     - gid: {{ user['prime_group']['gid'] }}

  74.     {%- elif 'uid' in user %}

  75.     - gid: {{ user['uid'] }}

  76.     {%- endif %}

  77.     {% if 'system' in user and user['system'] %}

  78.     - system: True

  79.     {% endif %}

  80.   user.present:

  81.     - name: {{ name }}

  82.     - home: {{ home }}

  83.     - shell: {{ user.get('shell', current.get('shell', users.get('shell', '/bin/bash'))) }}

  84.     {% if 'uid' in user -%}

  85.     - uid: {{ user['uid'] }}

  86.     {% endif -%}

  87.     {% if 'password' in user -%}

  88.     - password: '{{ user['password'] }}'

  89.     {% endif -%}

  90.     {% if user.get('empty_password') -%}

  91.     - empty_password: {{ user.get('empty_password') }}

  92.     {% endif -%}

  93.     {% if 'enforce_password' in user -%}

  94.     - enforce_password: {{ user['enforce_password'] }}

  95.     {% endif -%}

  96.     {% if 'hash_password' in user -%}

  97.     - hash_password: {{ user['hash_password'] }}

  98.     {% endif -%}

  99.     {% if user.get('system', False) -%}

  100.     - system: True

  101.     {% endif -%}

  102.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  103.     - gid: {{ user['prime_group']['gid'] }}

  104.     {% else -%}

  105.     - gid_from_name: True

  106.     {% endif -%}

  107.     {% if 'fullname' in user %}

  108.     - fullname: {{ user['fullname'] }}

  109.     {% endif -%}

  110.     {% if 'roomnumber' in user %}

  111.     - roomnumber: {{ user['roomnumber'] }}

  112.     {% endif %}

  113.     {% if 'workphone' in user %}

  114.     - workphone: {{ user['workphone'] }}

  115.     {% endif %}

  116.     {% if 'homephone' in user %}

  117.     - homephone: {{ user['workphone'] }}

  118.     {% endif %}

  119.     {% if not user.get('createhome', True) %}

  120.     - createhome: False

  121.     {% endif %}

  122.     {% if 'expire' in user -%}

  123.         {% if grains['kernel'].endswith('BSD') and

  124.             user['expire'] < 157766400 %}

  125.         {# 157762800s since epoch equals 01 Jan 1975 00:00:00 UTC #}

  126.     - expire: {{ user['expire'] * 86400 }}

  127.         {% elif grains['kernel'] == 'Linux' and

  128.             user['expire'] > 84006 %}

  129.         {# 2932896 days since epoch equals 9999-12-31 #}

  130.     - expire: {{ (user['expire'] / 86400) | int}}

  131.         {% else %}

  132.     - expire: {{ user['expire'] }}

  133.         {% endif %}

  134.     {% endif -%}

  135.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  136.     - groups:

  137.       - {{ user_group }}

  138.       {% for group in user.get('groups', []) -%}

  139.       - {{ group }}

  140.       {% endfor %}

  141.     {% if 'optional_groups' in user %}

  142.     - optional_groups:

  143.       {% for optional_group in user['optional_groups'] -%}

  144.       - {{optional_group}}

  145.       {% endfor %}

  146.     {% endif %}

  147.     - require:

  148.       - group: {{ user_group }}

  149.       {% for group in user.get('groups', []) -%}

  150.       - group: {{ group }}

  151.       {% endfor %}

  152. 

  153. 

  154.   {% if 'ssh_keys' in user or

  155.       'ssh_auth' in user or

  156.       'ssh_auth_file' in user or

  157.       'ssh_auth_pillar' in user or

  158.       'ssh_auth.absent' in user or

  159.       'ssh_config' in user %}

  160. user_keydir_{{ name }}:

  161.   file.directory:

  162.     - name: {{ home }}/.ssh

  163.     - user: {{ name }}

  164.     - group: {{ user_group }}

  165.     - makedirs: True

  166.     - mode: 700

  167.     - require:

  168.       - user: {{ name }}

  169.       - group: {{ user_group }}

  170.       {%- for group in user.get('groups', []) %}

  171.       - group: {{ group }}

  172.       {%- endfor %}

  173.   {% endif %}

  174. 

  175.   {% if 'ssh_keys' in user %}

  176.   {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}

  177. users_user_{{ name }}_private_key:

  178.   file.managed:

  179.     - name: {{ home }}/.ssh/{{ key_type }}

  180.     - user: {{ name }}

  181.     - group: {{ user_group }}

  182.     - mode: 600

  183.     - show_diff: False

  184.     - contents_pillar: users:{{ name }}:ssh_keys:privkey

  185.     - require:

  186.       - user: users_{{ name }}_user

  187.       {% for group in user.get('groups', []) %}

  188.       - group: users_{{ name }}_{{ group }}_group

  189.       {% endfor %}

  190. users_user_{{ name }}_public_key:

  191.   file.managed:

  192.     - name: {{ home }}/.ssh/{{ key_type }}.pub

  193.     - user: {{ name }}

  194.     - group: {{ user_group }}

  195.     - mode: 644

  196.     - show_diff: False

  197.     - contents_pillar: users:{{ name }}:ssh_keys:pubkey

  198.     - require:

  199.       - user: users_{{ name }}_user

  200.       {% for group in user.get('groups', []) %}

  201.       - group: users_{{ name }}_{{ group }}_group

  202.       {% endfor %}

  203.   {% endif %}

  204. 

  205. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  206. users_authorized_keys_{{ name }}:

  207.   file.managed:

  208.     - name: {{ home }}/.ssh/authorized_keys

  209.     - user: {{ name }}

  210.     - group: {{ user_group }}

  211.     - mode: 600

  212. {% if 'ssh_auth_file' in user %}

  213.     - contents: |

  214.         {% for auth in user.ssh_auth_file -%}

  215.         {{ auth }}

  216.         {% endfor -%}

  217. {% else %}

  218.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].items() %}

  219.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  220.         {%- endfor %}

  221. {% endif %}

  222. {% endif %}

  223. 

  224. {% if 'ssh_auth' in user %}

  225. {% for auth in user['ssh_auth'] %}

  226. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  227.   ssh_auth.present:

  228.     - user: {{ name }}

  229.     - name: {{ auth }}

  230.     - require:

  231.         - file: user_keydir_{{ name }}

  232.         - user: users_{{ name }}_user

  233. {% endfor %}

  234. {% endif %}

  235. 

  236. {% if 'ssh_keys_pillar' in user %}

  237. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  238. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  239.   file.managed:

  240.     - name: {{ home }}/.ssh/{{ key_name }}

  241.     - user: {{ name }}

  242.     - group: {{ user_group }}

  243.     - mode: 600

  244.     - show_diff: False

  245.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  246.     - require:

  247.       - user: users_{{ name }}_user

  248.       {% for group in user.get('groups', []) %}

  249.       - group: users_{{ name }}_{{ group }}_group

  250.       {% endfor %}

  251. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  252.   file.managed:

  253.     - name: {{ home }}/.ssh/{{ key_name }}.pub

  254.     - user: {{ name }}

  255.     - group: {{ user_group }}

  256.     - mode: 644

  257.     - show_diff: False

  258.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  259.     - require:

  260.       - user: users_{{ name }}_user

  261.       {% for group in user.get('groups', []) %}

  262.       - group: users_{{ name }}_{{ group }}_group

  263.       {% endfor %}

  264. {% endfor %}

  265. {% endif %}

  266. 

  267. {% if 'ssh_auth_sources' in user %}

  268. {% for pubkey_file in user['ssh_auth_sources'] %}

  269. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  270.   ssh_auth.present:

  271.     - user: {{ name }}

  272.     - source: {{ pubkey_file }}

  273.     - require:

  274.         - file: users_{{ name }}_user

  275.         - user: users_{{ name }}_user

  276. {% endfor %}

  277. {% endif %}

  278. 

  279. {% if 'ssh_auth.absent' in user %}

  280. {% for auth in user['ssh_auth.absent'] %}

  281. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  282.   ssh_auth.absent:

  283.     - user: {{ name }}

  284.     - name: {{ auth }}

  285.     - require:

  286.         - file: users_{{ name }}_user

  287.         - user: users_{{ name }}_user

  288. {% endfor %}

  289. {% endif %}

  290. 

  291. {% if 'ssh_config' in user %}

  292. users_ssh_config_{{ name }}:

  293.   file.managed:

  294.     - name: {{ home }}/.ssh/config

  295.     - user: {{ name }}

  296.     - group: {{ user_group }}

  297.     - mode: 640

  298.     - contents: |

  299.         # Managed by Saltstack

  300.         # Do Not Edit

  301.         {% for label, setting in user.ssh_config.items() %}

  302.         # {{ label }}

  303.         Host {{ setting.get('hostname') }}

  304.           {%- for opts in setting.get('options') %}

  305.           {{ opts }}

  306.           {%- endfor %}

  307.         {% endfor -%}

  308. {% endif %}

  309. 

  310. {% if 'ssh_known_hosts' in user %}

  311. {% for hostname, host in user['ssh_known_hosts'].items() %}

  312. users_ssh_known_hosts_{{ name }}_{{ loop.index0 }}:

  313.   ssh_known_hosts.present:

  314.     - user: {{ name }}

  315.     - name: {{ hostname }}

  316.     {% if 'port' in host %}

  317.     - port: {{ host['port'] }}

  318.     {% endif -%}

  319.     {% if 'fingerprint' in host %}

  320.     - fingerprint: {{ host['fingerprint'] }}

  321.     {% endif -%}

  322.     {% if 'key' in host %}

  323.     - key: {{ host['key'] }}

  324.     {% endif -%}

  325.     {% if 'enc' in host %}

  326.     - enc: {{ host['enc'] }}

  327.     {% endif -%}

  328.     {% if 'hash_hostname' in host %}

  329.     - hash_hostname: {{ host['hash_hostname'] }}

  330.     {% endif -%}

  331. {% endfor %}

  332. {% endif %}

  333. 

  334. {% if 'ssh_known_hosts.absent' in user %}

  335. {% for host in user['ssh_known_hosts.absent'] %}

  336. users_ssh_known_hosts_delete_{{ name }}_{{ loop.index0 }}:

  337.   ssh_known_hosts.absent:

  338.     - user: {{ name }}

  339.     - name: {{ host }}

  340. {% endfor %}

  341. {% endif %}

  342. 

  343. {% if 'sudouser' in user and user['sudouser'] %}

  344. 

  345. users_sudoer-{{ name }}:

  346.   file.managed:

  347.     - replace: False

  348.     - name: {{ users.sudoers_dir }}/{{ name }}

  349.     - user: root

  350.     - group: {{ users.root_group }}

  351.     - mode: '0440'

  352. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  353. #{#%

  354. {% if 'sudo_rules' in user %}

  355. {% for rule in user['sudo_rules'] %}

  356. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  357.   cmd.run:

  358.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  359.     - stateful: True

  360.     - shell: {{ users.visudo_shell }}

  361.     - env:

  362.       # Specify the rule via an env var to avoid shell quoting issues.

  363.       - rule: "{{ name }} {{ rule }}"

  364.     - require_in:

  365.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  366. {% endfor %}

  367. {% endif %}

  368. {% if 'sudo_defaults' in user %}

  369. {% for entry in user['sudo_defaults'] %}

  370. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  371.   cmd.run:

  372.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  373.     - stateful: True

  374.     - shell: {{ users.visudo_shell }}

  375.     - env:

  376.       # Specify the rule via an env var to avoid shell quoting issues.

  377.       - rule: "Defaults:{{ name }} {{ entry }}"

  378.     - require_in:

  379.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  380. {% endfor %}

  381. {% endif %}

  382. #%#}

  383. 

  384. users_{{ users.sudoers_dir }}/{{ name }}:

  385.   file.managed:

  386.     - replace: True

  387.     - name: {{ users.sudoers_dir }}/{{ name }}

  388.     - contents: |

  389.       {%- if 'sudo_defaults' in user %}

  390.       {%- for entry in user['sudo_defaults'] %}

  391.         Defaults:{{ name }} {{ entry }}

  392.       {%- endfor %}

  393.       {%- endif %}

  394.       {%- if 'sudo_rules' in user %}

  395.         ########################################################################

  396.         # File managed by Salt (users-formula).

  397.         # Your changes will be overwritten.

  398.         ########################################################################

  399.         #

  400.       {%- for rule in user['sudo_rules'] %}

  401.         {{ name }} {{ rule }}

  402.       {%- endfor %}

  403.       {%- endif %}

  404.     - require:

  405.       - file: users_sudoer-defaults

  406.       - file: users_sudoer-{{ name }}

  407.   cmd.wait:

  408.     - name: visudo -cf {{ users.sudoers_dir }}/{{ name }} || ( rm -rvf {{ users.sudoers_dir }}/{{ name }}; exit 1 )

  409.     - watch:

  410.       - file: {{ users.sudoers_dir }}/{{ name }}

  411. {% endif %}

  412. {% else %}

  413. users_{{ users.sudoers_dir }}/{{ name }}:

  414.   file.absent:

  415.     - name: {{ users.sudoers_dir }}/{{ name }}

  416. {% endif %}

  417. 

  418. {%- if 'google_auth' in user %}

  419. {%- for svc in user['google_auth'] %}

  420. users_googleauth-{{ svc }}-{{ name }}:

  421.   file.managed:

  422.     - replace: false

  423.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  424.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  425.     - user: root

  426.     - group: {{ users.root_group }}

  427.     - mode: 400

  428.     - require:

  429.       - pkg: users_googleauth-package

  430. {%- endfor %}

  431. {%- endif %}

  432. 

  433. #

  434. # if not salt['cmd.has_exec']('git')

  435. # fails even if git is installed

  436. #

  437. # this doesn't work (Salt bug), therefore need to run state.apply twice

  438. #include:

  439. #  - users

  440. #

  441. #git:

  442. #  pkg.installed:

  443. #    - require_in:

  444. #      - sls: users

  445. #

  446. {% if 'gitconfig' in user %}

  447. {% for key, value in user['gitconfig'].items() %}

  448. users_{{ name }}_user_gitconfig_{{ loop.index0 }}:

  449.   {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  450.   git.config_set:

  451.   {% else %}

  452.   git.config:

  453.   {% endif %}

  454.     - name: {{ key }}

  455.     - value: "{{ value }}"

  456.     - user: {{ name }}

  457.     {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %}

  458.     - global: True

  459.     {% else %}

  460.     - is_global: True

  461.     {% endif %}

  462. {% endfor %}

  463. {% endif %}

  464. 

  465. {% endfor %}

  466. 

  467. 

  468. {% for name, user in pillar.get('users', {}).items()

  469.         if user.absent is defined and user.absent %}

  470. users_absent_user_{{ name }}:

  471. {% if 'purge' in user or 'force' in user %}

  472.   user.absent:

  473.     - name: {{ name }}

  474.     {% if 'purge' in user %}

  475.     - purge: {{ user['purge'] }}

  476.     {% endif %}

  477.     {% if 'force' in user %}

  478.     - force: {{ user['force'] }}

  479.     {% endif %}

  480. {% else %}

  481.   user.absent:

  482.     - name: {{ name }}

  483. {% endif -%}

  484. users_{{ users.sudoers_dir }}/{{ name }}:

  485.   file.absent:

  486.     - name: {{ users.sudoers_dir }}/{{ name }}

  487. {% endfor %}

  488. 

  489. {% for user in pillar.get('absent_users', []) %}

  490. users_absent_user_2_{{ user }}:

  491.   user.absent:

  492.     - name: {{ user }}

  493. users_2_{{ users.sudoers_dir }}/{{ user }}:

  494.   file.absent:

  495.     - name: {{ users.sudoers_dir }}/{{ user }}

  496. {% endfor %}

  497. 

  498. {% for group in pillar.get('absent_groups', []) %}

  499. users_absent_group_{{ group }}:

  500.   group.absent:

  501.     - name: {{ group }}

  502. {% endfor %}