o

�N�gUN�@sjdZd
dl
Z
d
dlZdd�Zdd�Z							dd
d�
Z							ddd
�
Z							ddd�
ZdS)aC
Control of entries in SSH authorized_key files
==============================================

The information stored in a user's SSH authorized key file can be easily
controlled via the ssh_auth state. Defaults can be set by the enc, options,
and comment keys. These defaults can be overridden by including them in the
name.

Since the YAML specification limits the length of simple keys to 1024
characters, and since SSH keys are often longer than that, you may have
to use a YAML 'explicit key', as demonstrated in the second example below.

.. code-block:: yaml

    AAAAB3NzaC1kc3MAAACBAL0sQ9fJ5bYTEyY==:
      ssh_auth.present:
        - user: root
        - enc: ssh-dss

    ? AAAAB3NzaC1kc3MAAACBAL0sQ9fJ5bYTEyY==...
    :
      ssh_auth.present:
        - user: root
        - enc: ssh-dss

    thatch:
      ssh_auth.present:
        - user: root
        - source: salt://ssh_keys/thatch.id_rsa.pub
        - config: '%h/.ssh/authorized_keys'

    sshkeys:
      ssh_auth.present:
        - user: root
        - enc: ssh-rsa
        - options:
          - option1="value1"
          - option2="value2 flag2"
        - comment: myuser
        - names:
          - AAAAB3NzaC1kc3MAAACBAL0sQ9fJ5bYTEyY==
          - ssh-dss AAAAB3NzaCL0sQ9fJ5bYTEyY== user@domain
          - option3="value3" ssh-dss AAAAB3NzaC1kcQ9J5bYTEyY== other@testdomain
          - AAAAB3NzaC1kcQ9fJFF435bYTEyY== newcomment

    sshkeys:
      ssh_auth.manage:
        - user: root
        - enc: ssh-rsa
        - options:
          - option1="value1"
          - option2="value2 flag2"
        - comment: myuser
        - ssh_keys:
          - AAAAB3NzaC1kc3MAAACBAL0sQ9fJ5bYTEyY==
          - ssh-dss AAAAB3NzaCL0sQ9fJ5bYTEyY== user@domain
          - option3="value3" ssh-dss AAAAB3NzaC1kcQ9J5bYTEyY== other@testdomain
          - AAAAB3NzaC1kcQ9fJFF435bYTEyY== newcomment
�Nc	Cs�
d
}|rMtd|||t
|d�}	|	r2d}|	��D]\}
}|dkr q|d|�d|
�d�7}q|r2||fStjtd	jj�d
d
�}|rEd|fSdd
|�d�fSt�	d�
}
|
�
|
�
}|sl|
��}|d}
t|�
dkrk|d}n&|�
d�
ry|�
d�
�d�
}|�
d�
��}|d}|d}
t|�
dkr�|d}td||
|||||d�}|dkr�d|
�d|�d�}||fS|dkr�d|
�d|�d�}||fS|dkr�d}d�|
|�}||fS)z"
    Run checks for "present"
    N�ssh.check_key_file��saltenv�fingerprint_hash_type��existszSet to z: �

�	test.ping�ssh_auth.errorFT�All host keys in file z are already present�,^(.*?)\s?((?:sk-)?(?:ssh\-|ecds)[\w-]+\s.+)$r
��
�
,��
ssh.check_key��configr�update�Key �
 for user z is set to be updated�addz is set to be added�9The authorized host key {} is already present for user {})�__salt__�__env__�items�sys�modules�
__module__�__context__�pop�re�compile�search�split�len�group�format��user�name�enc�comment�options�sourcerr�result�keys�key�status�err�sshre�fullkey�key_and_comment�comps�check�r9�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/ssh_auth.py�
_present_testBsz






�








�


�






�












�	
	�
�


�r;c	Csv
d
}|rLtd|||t
|d�}	|	r1d}t|	���
D]\}
}|dkr"q|d|
�d�7}q|r1||fStjtdjj�d	d
�}|rDd
|fSdd|�d
�fSt	�
d�
}
|
�|
�
}|sk|
��}|d}
t
|�
dkrj|d}n&|�d�
rx|�d�
�d�
}|�d�
��}|d}|d}
t
|�
dkr�|d}td||
|||||d�}|dks�|dkr�d|
�d|�d�}||fSd}d}||fS)z!
    Run checks for "absent"
    NrrrrzSet to remove: rr	r
FTrz are already absentrr
r
rrrrrrrrrz is set for removalzKey is already absent)rr�listrrrrrr r!r"r#r$r%r&r(r9r9r:�_absent_test�sj






�








�







�












�	
�
r=�ssh-rsar�.ssh/authorized_keysc
Ks�|id
dd�}	|dkrTt�
d�
}
|
�|�
}|s,|�dd�}|d}t|�
dkr+|d}n(|�d�
r9|�d�
�d	�
}|�d�
�dd�}
|
d}|
d}t|
�
d
krT|
d}tdrmt|
||||p`g|||�\|	d<|	d
<|	S|dkrztd|dt	d�}|dkr�|s�d}nl|dkr�|r�td|t	d�}d}t�
d�
}
|�
��d�
}|D]=}|
�|�
}|s�td|
||t	|d�}q�|�d�
}|d}|d}t|�
dkr�|dn
d}td|
||||p�g||d�}q�ntd|
||||p�g||d�}|dk�
rd|	d|<d�||
�|	d
<|	S|dk�
rd�||
�|	d
<|	S|d k�
r(d!|	d|<d"�||
�|	d
<|	S|dk�
r:d|	d<d#�|�
|	d
<|	S|d$k�
r_d|	d<t
jtd%jj�d&d�}|�
rY||	d
<|	Sd'|	d
<|	S|d(k�
si|d)k�
rqd|	d<d*|	d
<|	S)+aa
    Verifies that the specified SSH key is present for the specified user

    name
        The SSH key to manage

    user
        The user who owns the SSH authorized keys file to modify

    enc
        Defines what type of key is being used, can be ed25519, ecdsa,
        ssh-rsa, ssh-dss or any other type as of openssh server version 8.7.

    comment
        The comment to be placed with the SSH public key

    source
        The source file for the key(s). Can contain any number of public keys,
        in standard "authorized_keys" format. If this is set, comment and enc
        will be ignored.

    .. note::
        The source file must contain keys in the format ``<enc> <key>
        <comment>``. If you have generated a keypair using PuTTYgen, then you
        will need to do the following to retrieve an OpenSSH-compatible public
        key.

        1. In PuTTYgen, click ``Load``, and select the *private* key file (not
           the public key), and click ``Open``.
        2. Copy the public key from the box labeled ``Public key for pasting
           into OpenSSH authorized_keys file``.
        3. Paste it into a new file.

    options
        The options passed to the key, pass a list object

    config
        The location of the authorized keys file relative to the user's home
        directory, defaults to ".ssh/authorized_keys". Token expansion %u and
        %h for username and home path supported.

    fingerprint_hash_type
        The public key fingerprint hash type that the public key fingerprint
        was originally hashed with. This defaults to ``sha256`` if not specified.
    Tr�r*�changesr/r,rNrr
r
rr�testr/r,z
cp.get_url�
rzno key�cp.get_file_strF�^(sk-)?(ssh\-|ecds).*rzssh.set_auth_key_from_file)rrr�
 zssh.set_auth_key)r+r,r-rr�replaceZUpdatedrAz2The authorized host key {} for user {} was updatedz	no changer�newZNewz0The authorized host key {} for user {} was addedz4Failed to add the ssh key. Source file {} is missingZfailr	r
z[Failed to add the ssh key. Is the home directory available, and/or does the key file exist?�invalidzInvalid public keyz@Invalid public ssh key, most likely has spaces or invalid syntax)r!r"r#r$r%r&�__opts__r;rr�rstrip�matchr'rrrrr )r*r)r+r,r.r-rr�kwargs�retr4r5r6r7�source_path�datar1�filehasoptions�keylineZkey_type�	key_valueZkey_commentr3r9r9r:�present�s�8






�














�

















�
	










��






�




�


��"
�


�
�


�
�


�

���
�rTc	Cs�
|id
dd�}tdr t
|
||||pg|||�\|d<|d<|S|dkrhtd|td�}	d	}
t�d
�
}|	���d�
}	|	D]*}|�|�
}
|
sStd|
||t|d
�|d<q<|�d�
}td|
|d||d�|d<q<nSt�d�
}|�	|�
}
|
s�|�dd�}|d}t
|�
dkr�|d}n&|
�d�
r�|
�d�
�d�
}|
�d�
��}|d}|d}t
|�
dkr�|d}td|
|||d�|d<|ddkr�d	|d<|S|ddkr�d|d|<|S)az
    Verifies that the specified SSH key is absent

    name
        The SSH key to manage

    user
        The user who owns the SSH authorized keys file to modify

    enc
        Defines what type of key is being used, can be ed25519, ecdsa,
        ssh-rsa, ssh-dss or any other type as of openssh server version 8.7.

    comment
        The comment to be placed with the SSH public key

    options
        The options passed to the key, pass a list object

    source
        The source file for the key(s). Can contain any number of public keys,
        in standard "authorized_keys" format. If this is set, comment, enc and
        options will be ignored.

        .. versionadded:: 2015.8.0

    config
        The location of the authorized keys file relative to the user's home
        directory, defaults to ".ssh/authorized_keys". Token expansion %u and
        %h for username and home path supported.

    fingerprint_hash_type
        The public key fingerprint hash type that the public key fingerprint
        was originally hashed with. This defaults to ``sha256`` if not specified.

        .. versionadded:: 2016.11.7
    Trr@rBr/r,rDrCFrErzssh.rm_auth_key_from_filerrFzssh.rm_auth_keyrrrNr
r
rrz%User authorized keys file not presentzKey removedZRemovedrA)rJr=rrr!r"rKr$rLr#r%r&)r*r)r+r,r.r-rrrNr1rQr4rRr5r6r7r9r9r:�absent�
sx/








�














�
	




��






�








�



rUc	
KsD
d
idd
d�}
g}|
D]
}|�|�
d�
�

qtd|||d���}
t|
�
�|�
}|D],}tdr>|�d�}||
d	<d
|
d<q*t||f||||||d�|	�
�
d	}||
d
|<q*|
D]F}t||||||||fi|	�
�
}|d
rx|
d
�	|d
�

n|
d	d|d	7<|
d	�
�|
d	<|dd
ur�d
|
d<qY|ds�d|
d<qY|
S)a�
    .. versionadded:: 3000

    Ensures that only the specified ssh_keys are present for the specified user

    ssh_keys
        The SSH key to manage

    user
        The user who owns the SSH authorized keys file to modify

    enc
        Defines what type of key is being used, can be ed25519, ecdsa,
        ssh-rsa, ssh-dss or any other type as of openssh server version 8.7.

    comment
        The comment to be placed with the SSH public key

    source
        The source file for the key(s). Can contain any number of public keys,
        in standard "authorized_keys" format. If this is set, comment and enc
        will be ignored.

    .. note::
        The source file must contain keys in the format ``<enc> <key>
        <comment>``. If you have generated a keypair using PuTTYgen, then you
        will need to do the following to retrieve an OpenSSH-compatible public
        key.

        1. In PuTTYgen, click ``Load``, and select the *private* key file (not
           the public key), and click ``Open``.
        2. Copy the public key from the box labeled ``Public key for pasting
           into OpenSSH authorized_keys file``.
        3. Paste it into a new file.

    options
        The options passed to the keys, pass a list object

    config
        The location of the authorized keys file relative to the user's home
        directory, defaults to ".ssh/authorized_keys". Token expansion %u and
        %h for username and home path supported.

    fingerprint_hash_type
        The public key fingerprint hash type that the public key fingerprint
        was originally hashed with. This defaults to ``sha256`` if not specified.
    rTr@rFz
ssh.auth_keys)r)rrrBz Key set for removalr,Nr/)r+r,r.r-rrrArF)�extendr$rr0�set�
differencerJrUrTr�strip)r*Zssh_keysr)r+r,r.r-rrrMrNZall_potential_keysZssh_keyZ
existing_keysZremove_keysZ
remove_keyZremove_commentZ
run_returnr9r9r:�managesl;

��








�




�	�
�








�	�





�rZ)r>rrNr?N)�__doc__r!rr;r=rTrUrZr9r9r9r:�<module>
s6=
LH





�<





�}




�