HEX
Server: Apache
System: Linux server2.voipitup.com.au 4.18.0-553.104.1.lve.el8.x86_64 #1 SMP Tue Feb 10 20:07:30 UTC 2026 x86_64
User: posscale (1027)
PHP: 8.2.29
Disabled: exec,passthru,shell_exec,system
$ pwd: /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/
Upload Files
File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/ssh.cpython-310.pyc
o

�N�g���@sdZddlZddlZddlZddlZddlZddlZddlZddlZ	ddl
Z	ddlZ	ddlZ	ddl
Z	ddlZ	ddlmZmZe�e�ZdZdd�Zdd�Zd	d
�Zdd�Zd
d�Z	dEdd�Zdd�Zdd�ZdFdd�ZdGdd�ZdHdd�Z 			dId d!�Z!			dJd"d#�Z"			dId$d%�Z#dKd&d'�Z$			dId(d)�Z%						dLd*d+�Z&d,d-�Z'dMd.d/�Z(e	j)j*j+�,d0�	dNd1d2��Z-e	j)j*j+�,d3�				4	dOd5d6��Z.							dPd7d8�Z/dQd9d:�Z0									4	dRd;d<�Z1dNd=d>�Z2e	j)j*j+�,d0�dFd?d@��Z3efdAdB�Z4dCdD�Z5dS)Sz�
Manage client ssh components

.. note::

    This module requires the use of MD5 hashing. Certain security audits may
    not permit the use of MD5. For those cases, this module should be disabled
    or removed.
�N)�CommandExecutionError�SaltInvocationError�cCstjj�d�s	dSdS)NZssh)Fz#The module requires the ssh binary.T)�salt�utils�path�which�r	r	�D/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/ssh.py�__virtual__ srcCs�gd�}gd�}gd�}ddg}gd�}||vrdS||vr dS||vr,|d	vr*d
S|S||vr2dS||vr8|Std|�d���)
z�
    Return the properly formatted ssh value for the authorized encryption key
    type. ecdsa defaults to 256 bits, must give full ecdsa enc schema string
    if using higher enc. If the type is not found, raise CommandExecutionError.
    )�r�rsa�ssh-rsa)�dZdsa�dss�ssh-dss)�e�ecdsazecdsa-sha2-nistp521zecdsa-sha2-nistp384�ecdsa-sha2-nistp256�ed25519zssh-ed25519)
zrsa-sha2-512zrsa-sha2-256z!rsa-sha2-512-cert-v01@openssh.comz!rsa-sha2-256-cert-v01@openssh.comzssh-rsa-cert-v01@openssh.comz(ecdsa-sha2-nistp256-cert-v01@openssh.comz(ecdsa-sha2-nistp384-cert-v01@openssh.comz(ecdsa-sha2-nistp521-cert-v01@openssh.comz"sk-ecdsa-sha2-nistp256@openssh.comz+sk-ecdsa-sha2-nistp256-cert-v01@openssh.comz ssh-ed25519-cert-v01@openssh.comzsk-ssh-ed25519@openssh.comz#sk-ssh-ed25519-cert-v01@openssh.comrr)rrrzIncorrect encryption key type 'z'.)r)�encr
rrrZalso_allowedr	r	r
�_refine_enc&s$rcCs:d}|r|d�d�|��7}||�d|�d|�d�7}|S)z%
    Properly format user input.
    �z{} �,� �
)�format�join)�keyr�comment�options�liner	r	r
�_format_auth_lineYs
r"cCs�d}d}|D]6}|r1d}|dkr|d7}n|dkr||7}n|dkr'||7}n	d�|�}t|��q|dkr8d}q||7}q|rEd}t|��|S)	zQ
    Expand the AuthorizedKeysFile expression. Defined in man sshd_config(5)
    rF�%�u�hz6AuthorizedKeysFile path: unknown token character "%{}"TzAAuthorizedKeysFile path: Last character can't be escape character)rr)r�user�homeZconverted_pathZ
had_escape�char�errorr	r	r
�_expand_authorized_keys_pathds.


�
r*cCsRtd|�}|std|�d���|d}t|||�}tj�|�s'tj�||�}|S)z3
    Get absolute path to a user's ssh_config.
    �	user.infozUser 'z' does not existr')�__salt__rr*�osr�isabsr)r&�config�uinfor'r	r	r
�_get_config_file�sr1rr�.ssh/authorized_keysc

Csjt||||pg�}g}t||�}z�tjj�|d��~}	|	D]B}
tjj�|
���}
|
dkr,q|
d7}
|
�	d�r;|�
|
�qt�d|
�}|rYt
|d�dkrY|dd|krY|�
|�q|�
|
�q|	��tjj�|d��}	|	�tjj�|��Wd	�n1s�wYWd	�Wd	SWd	�Wd	S1s�wYWd	Sty�}ztd
|����d	}~ww)z!
    Replace an existing key
    rrr�#zN((.*)\s)?((?:sk-)?(?:ssh|ecdsa)-[a-z0-9@.-]+)\s([a-zA-Z0-9+/]+={0,2})(\s(.*))?r��wbNz(Problem reading or writing to key file: )r"r1rr�files�fopen�stringutils�
to_unicode�strip�
startswith�append�re�findall�len�close�
writelines�data�encode�OSErrorr)
r&rrrr r/�	auth_line�lines�full�_fhr!�comps�excr	r	r
�_replace_auth_key�s>


�$��&���rKcCs4i}t�d�}z�tjj�|d��q}|D]d}tjj�|���}|dkr#q|d7}|�	d�r-qt�
||�}|s6q|�d�}|�d���}t
|�dkrIq|rQ|�d�}	ng}	|d	}
|d}d
�|dd��}t||�}
|
durnq|
||	|
d�||<qWd�W|S1s�wYW|Sty�td
|����w)zD
    Return a dict containing validated keys in the passed file
    �.^(.*?)\s?((?:sk-)?(?:ssh\-|ecds)[\w@.-]+\s.+)$rrrr3��rrrN)rrr �fingerprintzProblem reading ssh key file )r=�compilerrr6r7r8r9r:r;�search�group�splitr?r�_fingerprintrDr)�key_file�fingerprint_hash_type�ret�linererHr!rQ�optsrIr rrrrOr	r	r
�_validate_keys�sP



���/�/��rZcs�|r|��}nd}ztt|�}Wntytd|�d���wz	tj|dd�}Wntjy4YdSw||��	���fdd�t
d	t��d
�D�}d�|�S)a�
    Return a public key fingerprint based on its base64-encoded representation

    The fingerprint string is formatted according to RFC 4716 (ch.4), that is,
    in the form "xx:xx:...:xx"

    If the key is invalid (incorrect base64 string), return None

    public_key
        The public key to return the fingerprint for

    fingerprint_hash_type
        The public key fingerprint hash type that the public key fingerprint
        was originally hashed with. This defaults to ``sha256`` if not specified.

        .. versionadded:: 2016.11.4
        .. versionchanged:: 2017.7.0

            default changed from ``md5`` to ``sha256``

    �sha256zThe fingerprint_hash_type z is not supported.T)�validateNcsg|]
}�||d��qS)rNr	)�.0�i�rWr	r
�
<listcomp> sz _fingerprint.<locals>.<listcomp>rrN�:)
�lower�getattr�hashlib�AttributeErrorr�base64�	b64decode�binascii�Error�	hexdigest�ranger?r)Z
public_keyrVZ	hash_typeZ	hash_funcZraw_key�chunksr	r_r
rT�s$

���
rTcCsp|r|pd}n|p
d}tj�|�r|}|S|r3td|�}|s(dd|�d�d�Stj�|d|�}|Sdd	d�S)
N�.ssh/known_hosts�/etc/ssh/ssh_known_hostsr+r)zUser � does not exist��statusr)r'z'Cannot determine absolute path to file.)r-rr.r,r)r/r&rGr0r	r	r
�_get_known_hosts_file$s"
�
���rrTc		CsZ|stddkrd}ntd��i}t�d�}t�|�D]�}|�|�}|r�|�d�s4|dur4t�	d|�q|�d	�rD|durDt�	d
|�q|�d�}|�d�rU||�d�7}zGt
jj�
tj�||�d��0}t
jj�|���||<||d
kr�||t
jj�|���7<||��||<Wd�n1s�wYWqty�d||<Yqwq|S)a
    Return the minion's host keys

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.host_keys
        salt '*' ssh.host_keys keydir=/etc/ssh
        salt '*' ssh.host_keys keydir=/etc/ssh private=False
        salt '*' ssh.host_keys keydir=/etc/ssh certs=False
    Zkernel�Linuxz/etc/sshz&ssh.host_keys: Please specify a keydirz8ssh_host_(?P<type>.+)_key(?P<pub>(?P<cert>-cert)?\.pub)?ZpubFz7Skipping private key file %s as private is set to False�certz-Skipping key file %s as certs is set to False�typerz SSH PRIVATE KEY FILE FORMAT 1.1
Nr)�
__grains__rr=rPr-�listdir�matchrR�log�inforrr6r7rrr8r9�readline�readr:rD)	ZkeydirZprivate�certs�keysZfnre�fn_�mZknamerHr	r	r
�	host_keys>s>



����r�c	Cs�|std�}d}t|t�s|g}d}i}|D]$}d}zt||�}Wn	ty+Ynw|r;tj�|�r;t||�||<q|rL|d|vrJ||dSiS|S)z�
    Return the authorized keys for users

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.auth_keys
        salt '*' ssh.auth_keys root
        salt '*' ssh.auth_keys user=root
        salt '*' ssh.auth_keys user="[user1, user2]"
    �user.list_usersFTNr)	r,�
isinstance�listr1rr-r�isfilerZ)r&r/rVZold_output_when_one_userr~r$rGr	r	r
�	auth_keysss,

��r��basec

Cs�td||�}|siSt||�}|s#d|�d�}t�|�|td<iSi}|D]}	t||	||	d||	d||	d||d�||	<q'|S)	z�
    Check a keyfile from a source destination against the local keys and
    return the keys to change

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.check_key_file root salt://ssh/keyfile
    �
cp.cache_file�No keys detected in �. Is file properly formatted?�ssh_auth.errorrrr �r/rV)r,rZryr)�__context__�	check_key)
r&�sourcer/�saltenvrV�keyfile�s_keys�errrWrr	r	r
�check_key_file�s*




�	r�cCsr|durg}t|�}t|||d�}t||||�}	||vr7t|||d||d||d�}
|
|	kr5dSdSdS)	z�
    Check to see if a key needs updating, returns "update", "add" or "exists"

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.check_key <user> <key> <enc> <comment> <options>
    Nr�rrr �update�add�exists)rr�r")r&rrrr r/�
cache_keysrV�currentZnlineZcliner	r	r
r��s� ��r�c
Cs�td||�}tj�|�std��t||�}|s)d|�d�}t�|�|td<dSd}|D]}	|t	||	||d�7}q-d	|vr@d	Sd
|vrFd
SdS)z�
    Remove an authorized key from the specified user's authorized key file,
    using a file as source

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.rm_auth_key_from_file <user> salt://ssh_keys/<user>.id_rsa.pub
    r��-Failed to pull key file from salt file serverr�r�r��failrr��Key not removed�Key removed�Key not present)
r,r-rr�rrZryr)r��rm_auth_key�
r&r�r/r�rVZlfiler�r��rvalrr	r	r
�rm_auth_key_from_file�s&


�r�c
Cs�t|||d�}t�d�}||vr�t||�}tj�|�s!d|�d�Sg}z�tjj	�
|d��T}|D]I}	tjj�|	�
��}	|	dkr?q/|	d7}	|	�d�rN|�|	�q/t�||	�}
|
sWq/|
�d	���}t|�d	krj|�|	�q/|d
}||krsq/|�|	�q/Wd�n1s�wYtjj	�
|d��}|�tjj�|��Wd�WdS1s�wYWdSty�}
z
t�d
|
�WYd}
~
dSd}
~
wwdS)z�
    Remove an authorized key from the specified user's authorized key file

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.rm_auth_key <user> <key>
    r�rLzAuthorized keys file z not presentrrrr3rNrMNr5z!Could not read/write key file: %sr�r�r�)r�r=rPr1r-rr�rrr6r7r8r9r:r;r<rQrRrSr?rArBrCrDry�warning)r&rr/rVr�rXrGrFrHr!rQrIZpkeyrJr	r	r
r�%sX
�




��%�����r�c
Cs�td||�}tj�|�std��t||�}|s)d|�d�}t�|�|td<dSd}|D] }	|t	||	||	d||	d	||	d
|t
|���|d�7}q-d|vrTdSd|vrZdSd
|vr`d
SdS)z�
    Add a key to the authorized_keys file, using a file as the source.

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.set_auth_key_from_file <user> salt://ssh_keys/<user>.id_rsa.pub
    r�r�r�r�r�r�rrrr )rrr r/r�rV�replace�new�	no change)r,r-rr�rrZryr)r��set_auth_keyr�r~r�r	r	r
�set_auth_key_from_filens8






�r�c
Cs�|durg}t|���dkrdSt|�}td|�}|sdSt||�du}	|	s)dSt||||||||d�}
|
dkrFt|||||pAg|�d	S|
d
krLdSt||||�}t||�}|�	dd
�}
|�
|
�rktj�
|
�skdStj�
tj�|��s�tj�|�}t�|�tjj��s�t��dkr�t�||d|d�t�|d�tjj�d�}|r�||g}t�|�tj�|�s�d}nd}zFtjj�|d��4}|dur�|�dd�|��dkr�|�dd�|�d�dkr�|� d�|� tjj!�"|��Wd�n1s�wYWnt#�y}z	d}t$|�%|���d}~ww|�rLtjj���s9t��dk�r3t�||d|d�t�|d�tjj�d�}|�rL||g}t�|�dS)ah
    Add a key to the authorized_keys file. The "key" parameter must only be the
    string of text that is the encoded key. If the key begins with "ssh-rsa"
    or ends with user@host, remove those from the key before passing it to this
    function.

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.set_auth_key <user> '<key>' enc='dsa'
    NrM�invalidr+r�zInvalid public key)r/r�rVr�r�r�r�r'rr�uid�gid�Z
restoreconTFzab+rN����
z Could not write to key file: {0}�r�)&r?rSrr,rTr�rKr"r1�getr;r-r�isdir�dirname�makedirsrr�platform�
is_windows�geteuid�chown�chmodr�
subprocess�callr�r6r7�seek�tellr|�writer8�to_bytesrDrr)r&rrrr r/r�rVr0Zkey_is_validrqrEZfconfigZudirZdpathZrcon�cmdZnew_filerHrJ�msgr	r	r
r��s��




����
r�ccsl�|r|nd}t|�D](\}}|ddkr3t|����d�}||d����d}||kr0q|VqdS)z�
    Helper function which parses ssh-keygen -F function output and yield line
    number of known_hosts entries with encryption key type matching enc,
    one by one.
    r
rNrr�rM���N)�	enumerate�intr:rS)rFrr^r!�line_noZline_encr	r	r
�_get_matched_host_line_numberss���r�c	cs~�|D]9}|��}|dkrq|d7}|�d�rqz	|��\}}}Wn	ty*Yqwt||d�}|s4q||||d�VqdS)z�
    Helper function which parses ssh-keygen -F and ssh-keyscan function output
    and yield dict with keys information, one by one.
    rrr3�rV)�hostnamerrrON)r:r;rS�
ValueErrorrT)rFrVr!r�rrrOr	r	r
�_parse_openssh_output"s$�
��r��
ssh-keygenc
Csdt||d�}t|t�r
|St||�}dd|d|g}td|ddd���}tt||d	��}	|	r0|	Sd
S)a
    .. versionadded:: 2018.3.0

    Return information about known host entries from the configfile, if any.
    If there are no entries for a matching hostname, return None.

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.get_known_host_entries <user> <hostname>
    �r/r&r��-F�-f�cmd.runTF�Zignore_retcode�python_shellr�N)rrr��dict�"_hostname_and_port_to_ssh_hostnamer,�
splitlinesr�r�)
r&r�r/�portrVrG�ssh_hostnamer�rF�known_host_entriesr	r	r
�get_known_host_entries:s

��
�r��ssh-keyscan�cCs�d}dg}|r|�d|g�|r|�d|g�|s't�d�|vr'|�ddg�|r.|�d�|�dt|�g�|�|�d	}d
}	|sZ|	dkrZ|	d}	td
|dd���}|sZ|	dksFtt||d��}
|
rf|
Sd	S)a9
    .. versionadded:: 2018.3.0

    Retrieve information about host public keys from remote server

    hostname
        The name of the remote host (e.g. "github.com")

    enc
        Defines what type of key is being used, can be ed25519, ecdsa,
        ssh-rsa, ssh-dss or any other type as of openssh server version 8.7.

    port
        Optional parameter, denoting the port of the remote host on which an
        SSH daemon is running. By default the port 22 is used.

    hash_known_hosts : True
        Hash all hostnames and addresses in the known hosts file.

    timeout : int
        Set the timeout for connection attempts.  If ``timeout`` seconds have
        elapsed since a connection was initiated to a host or since the last
        time anything was read from that host, then the connection is closed
        and the host in question considered unavailable.  Default is 5 seconds.

    fingerprint_hash_type
        The fingerprint hash type that the public key fingerprints were
        originally hashed with. This defaults to ``sha256`` if not specified.

        .. versionadded:: 2016.11.4
        .. versionchanged:: 2017.7.0

            default changed from ``md5`` to ``sha256``

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.recv_known_host_entries <hostname> enc=<enc> port=<port>
    )zCentOS-5r�z-pz-tZosfingerr
�-Hz-TNr�rrMr�F�r�r�)	�extendrvr�r<�strr,r�r�r�)r�rr��hash_known_hosts�timeoutrVZneed_dash_tr�rFZattemptsr�r	r	r
�recv_known_host_entriesZs,3

�
�r�c
Cs�|sddd�S|s|pd}n|pd}t|||||d�}|r$dd�|D�ng}|r/d	d�|D�ng}	|s5d
S|r?||vr=dSdS|rI||	vrGdSdSdS)
a8
    Check the record in known_hosts file, either by its value or by fingerprint
    (it's enough to set up either key or fingerprint, you don't need to set up
    both).

    If provided key or fingerprint doesn't match with stored value, return
    "update", if no value is found for a given host, return "add", otherwise
    return "exists".

    If neither key, nor fingerprint is defined, then additional validation is
    not performed.

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.check_known_host <user> <hostname> key='AAAA...FAaQ=='
    r)�hostname argument requiredrprnrm�r/r�rVcS�g|]}|d�qS�rr	�r]r%r	r	r
r`��z$check_known_host.<locals>.<listcomp>cSr��rOr	r�r	r	r
r`�r�r�r�r�)r�)
r&r�rrOr/r�rVr��
known_keys�known_fingerprintsr	r	r
�check_known_host�s,

��r�c	Cs�|sddd�St||d�}t|t�r|Stj�|�s#dd|�d�d�St||�}dd|d	|g}td
|dd�}tj	j
��sVt��d
krV|rVtd|�}t�
||d|d�d|d�S)z�
    Remove all keys belonging to hostname from a known_hosts file.

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.rm_known_host <user> <hostname>
    r)r�rpr��Known hosts file ror�z-Rr�r�Fr�rr+r�r�Zremoved�rqr)rrr�r�r-rr�r�r,rrr�r�r�r�)	r&r�r/r�rGr�r��
cmd_resultr0r	r	r
�
rm_known_host�s"



�

r�c
#
Cs�|sddd�S|dur|tkr|rddd�Sd}
d}t|||||	d�}|r,dd	�|D�ng}
|r7d
d	�|D�ng}|s>d}
n|rG||vrGd}
n|rP||
vrPd}
n
|durZ|durZd}|
sc|scd|
d
�S|s�t||||||	d�}|rxdd	�|D�ng}|r�dd	�|D�ng}|s�ddd�S|r�||vr�ddd�S|r�|D]
}||
vr�d|
d
�Sq�t||d�}t|t�r�|Stj�|��rAt�	|�j
}t||�}dd|d|g}td|ddd��
�}tt||��}|�r@zGtjj�|d��4}tjj�t|��}t|dd�D]}||d=q�|�d�|��|�tjjj|dd��Wd�n	1�s%wYWnt�y?}ztd�|���d}~wwnd}|�rM|||d�g}g}|D].}|�sd|tdfv�sdd |d!v�rmd"jd6i|��}n||d#<d$jd6i|��}|�|��qQtj�|�}|�r�td%|�}z
t� d&|�t�!|�Wn4t�y�} z'| j"dd'k�r�t�#d(|| j"d�n| j"dd)k�r�t� d*|�WYd} ~ nd} ~ ww|�r�t�$||d+|d,�t�%|d-�z%tjj�|d.��}|�tjj�&|��Wd�n	1�swYWnt�y}ztd/|�d0���d}~wwtjj'�(��sLt�)�dk�r<|�r<t�$||d+|d,�|�rFt�%||�nt�%|d1�|�rZ|�rZtd2||d3�}!d4||d5�}"|"S)7a�
    Download SSH public key from remote host "hostname", optionally validate
    its fingerprint against "fingerprint" variable and save the record in the
    known_hosts file.

    If such a record does already exists in there, do nothing.

    user
        The user who owns the ssh authorized keys file to modify

    hostname
        The name of the remote host (e.g. "github.com")

    fingerprint
        The fingerprint of the key which must be present in the known_hosts
        file (optional if key specified)

    key
        The public key which must be presented in the known_hosts file
        (optional if fingerprint specified)

    port
        optional parameter, denoting the port of the remote host, which will be
        used in case, if the public key will be requested from it. By default
        the port 22 is used.

    enc
        Defines what type of key is being used, can be ed25519, ecdsa,
        ssh-rsa, ssh-dss or any other type as of openssh server version 8.7.

    config
        The location of the authorized keys file relative to the user's home
        directory, defaults to ".ssh/known_hosts". If no user is specified,
        defaults to "/etc/ssh/ssh_known_hosts". If present, must be an
        absolute path when a user is not specified.

    hash_known_hosts : True
        Hash all hostnames and addresses in the known hosts file.

    timeout : int
        Set the timeout for connection attempts.  If ``timeout`` seconds have
        elapsed since a connection was initiated to a host or since the last
        time anything was read from that host, then the connection is closed
        and the host in question considered unavailable.  Default is 5 seconds.

        .. versionadded:: 2016.3.0

    fingerprint_hash_type
        The public key fingerprint hash type that the public key fingerprint
        was originally hashed with. This defaults to ``sha256`` if not specified.

        .. versionadded:: 2016.11.4
        .. versionchanged:: 2017.7.0

            default changed from ``md5`` to ``sha256``

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.set_known_host <user> fingerprint='xx:xx:..:xx' enc='ssh-rsa' config='.ssh/known_hosts'
    r)r�rpNzKargument port can not be used in conjunction with argument hash_known_hostsFr�cSr�r�r	r�r	r	r
r`_r�z"set_known_host.<locals>.<listcomp>cSr�r�r	r�r	r	r
r`ar�Tr�)rqr~)rr�r�r�rVcSr�r�r	r�r	r	r
r`{r�cSr�r�r	r�r	r	r
r`~r�z"Unable to receive remote host keysz\Remote host public keys found but none of their fingerprints match the one you have providedr�r�r�r�r�r�zr+)�reverserMr)Zto_strz:Couldn't remove old entry(ies) from known hosts file: '{}')r�rrrar�z{hostname} {enc} {key}
r�z [{hostname}]:{port} {enc} {key}
r+z#Ensuring ssh config dir "%s" existszPermission deniedz!Unable to create directory %s: %szFile existsz'%s already exists, no need to create itr�r�r��abz&Couldn't append to known hosts file: '�'r�zssh.hash_known_hosts)r&r/�updated)rq�oldr�r	)*�DEFAULT_SSH_PORTr�r�rrr�r�r-rr��stat�st_moder�r,r�r�r�rrr6r7rB�decode�sortedr��truncaterArDrrr<r�ry�debugr��argsr)r�r�rCr�r�r�)#r&r�rOrr�rr/r�r�rVZupdate_requiredZcheck_requiredZstored_host_entriesZstored_keysZstored_fingerprintsZremote_host_entriesr�r�rG�origmoder�r�rFZremove_linesZofileZknown_hosts_linesr��	exception�entryr!Zssh_dirr0rJr�r�r	r	r
�set_known_hostsJ
���
�
���
��

��
�������������
���r�c
Csn|std�}t|t�s|g}i}|D]�}i||<td|�}d|vr$qg}|r.|�|�n
|dur8|gd�7}|r@|�|�n
|durJ|gd�7}|D]V}|�d�r\tj�|�}|}	n
|}d�|d|�}	tj�	|	�r�z,t
jj�
|	d	��}
d
�t
jj�|
������|||<Wd�n1s�wYWqLty�YqLwqLqi}|D]}||r�||||<q�|S)a�

    Return the user's ssh keys on the minion

    .. versionadded:: 2014.7.0

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.user_keys
        salt '*' ssh.user_keys user=user1
        salt '*' ssh.user_keys user=user1 pubfile=/home/user1/.ssh/id_rsa.pub prvfile=/home/user1/.ssh/id_rsa
        salt '*' ssh.user_keys user=user1 prvfile=False
        salt '*' ssh.user_keys user="['user1','user2'] pubfile=id_rsa.pub prvfile=id_rsa

    As you can see you can tell Salt not to read from the user's private (or
    public) key file by setting the file path to ``False``. This can be useful
    to prevent Salt from publishing private data via Salt Mine or others.
    r�r+r'F)z
id_rsa.pubz
id_dsa.pubzid_ecdsa.pubzid_ed25519.pub)Zid_rsaZid_dsaZid_ecdsaZ
id_ed25519�/z
{}/.ssh/{}rrN)r,r�r�r<r;r-r�basenamerr�rrr6r7rrBr��	readlinesr:rD)r&ZpubfileZprvfiler~r$�userinfoZuserKeysrZkeynamerrHZ_keysr	r	r
�	user_keys�s\


��������rcCs�t||d�}t|t�r
|Stj�|�sdd|�d�d�St�|�j}ddd|g}td	|d
d�}t�	||�t
jj�
�sUt��dkrU|rUtd
|�}t�||d|d�d|d�S)aI

    Hash all the hostnames in the known hosts file.

    .. versionadded:: 2014.7.0

    user
        hash known hosts of this user

    config
        path to known hosts file: can be absolute or relative to user's home
        directory

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.hash_known_hosts

    r�r)r�rorpr�r�r�r�Fr�rr+r�r�r�r�)rrr�r�r-rr�r�r�r,r�rrr�r�r�r�)r&r/rGr�r�r�r0r	r	r
r�Es 

�
r�cCs |r|tkr|Sd|�d|��S)N�[z]:)r�)r�r�r	r	r
r�qsr�cCstd|�S)ai
    .. versionadded:: 2015.8.7

    Function to determine whether or not a private key is encrypted with a
    passphrase.

    Checks key for a ``Proc-Type`` header with ``ENCRYPTED`` in the value. If
    found, returns ``True``, otherwise returns ``False``.

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.key_is_encrypted /root/id_rsa
    zssh.key_is_encrypted)Z	__utils__r�r	r	r
�key_is_encryptedxsr)rrNr2)NN)NTT)Nr2N)r2r�N)r2NN)r2N)rrNr2NN)N)NNN)NNTr�N)NNNNNNN)NNNN)
NNNNNNNTr�N)6�__doc__rfrhrd�loggingr-r=r�Zsalt.utils.datarZsalt.utils.decorators.pathZsalt.utils.filesZsalt.utils.pathZsalt.utils.platformZsalt.utils.stringutilsZsalt.exceptionsrr�	getLogger�__name__ryr�rrr"r*r1rKrZrTrrr�r�r�r�r�r�r�r�r�r�rZ
decoratorsrrr�r�r�r�r�rr�r�rr	r	r	r
�<module>s�

3
�,:
-

5,
�/
�6
�
-L
�9
�n
��K
�
8$
�
xN+
@ Telegram