�
�Udac @` sG d d l m Z m Z m Z e Z i d d 6d g d 6d d 6Z d Z d Z d
Z d d l
Z
d d l Z d d l Z d d l
Z
d d l m Z d d
l m Z m Z d d l m Z d d l m Z d d l m Z d d l m Z d d l m Z d e f d � � YZ d e f d � � YZ d � Z e d k rCe � n d S( i ( t absolute_importt divisiont print_functions 1.1t metadata_versiont previewt statust communityt supported_bys�
---
module: openssh_cert
author: "David Kainz (@lolcube)"
version_added: "2.8"
short_description: Generate OpenSSH host or user certificates.
description:
- Generate and regenerate OpenSSH host or user certificates.
requirements:
- "ssh-keygen"
options:
state:
description:
- Whether the host or user certificate should exist or not, taking action if the state is different from what is stated.
type: str
default: "present"
choices: [ 'present', 'absent' ]
type:
description:
- Whether the module should generate a host or a user certificate.
- Required if I(state) is C(present).
type: str
choices: ['host', 'user']
force:
description:
- Should the certificate be regenerated even if it already exists and is valid.
type: bool
default: false
path:
description:
- Path of the file containing the certificate.
type: path
required: true
signing_key:
description:
- The path to the private openssh key that is used for signing the public key in order to generate the certificate.
- Required if I(state) is C(present).
type: path
public_key:
description:
- The path to the public key that will be signed with the signing key in order to generate the certificate.
- Required if I(state) is C(present).
type: path
valid_from:
description:
- "The point in time the certificate is valid from. Time can be specified either as relative time or as absolute timestamp.
Time will always be interpreted as UTC. Valid formats are: C([+-]timespec | YYYY-MM-DD | YYYY-MM-DDTHH:MM:SS | YYYY-MM-DD HH:MM:SS | always)
where timespec can be an integer + C([w | d | h | m | s]) (e.g. C(+32w1d2h).
Note that if using relative time this module is NOT idempotent."
- Required if I(state) is C(present).
type: str
valid_to:
description:
- "The point in time the certificate is valid to. Time can be specified either as relative time or as absolute timestamp.
Time will always be interpreted as UTC. Valid formats are: C([+-]timespec | YYYY-MM-DD | YYYY-MM-DDTHH:MM:SS | YYYY-MM-DD HH:MM:SS | forever)
where timespec can be an integer + C([w | d | h | m | s]) (e.g. C(+32w1d2h).
Note that if using relative time this module is NOT idempotent."
- Required if I(state) is C(present).
type: str
valid_at:
description:
- "Check if the certificate is valid at a certain point in time. If it is not the certificate will be regenerated.
Time will always be interpreted as UTC. Mainly to be used with relative timespec for I(valid_from) and / or I(valid_to).
Note that if using relative time this module is NOT idempotent."
type: str
principals:
description:
- "Certificates may be limited to be valid for a set of principal (user/host) names.
By default, generated certificates are valid for all users or hosts."
type: list
elements: str
options:
description:
- "Specify certificate options when signing a key. The option that are valid for user certificates are:"
- "C(clear): Clear all enabled permissions. This is useful for clearing the default set of permissions so permissions may be added individually."
- "C(force-command=command): Forces the execution of command instead of any shell or
command specified by the user when the certificate is used for authentication."
- "C(no-agent-forwarding): Disable ssh-agent forwarding (permitted by default)."
- "C(no-port-forwarding): Disable port forwarding (permitted by default)."
- "C(no-pty Disable): PTY allocation (permitted by default)."
- "C(no-user-rc): Disable execution of C(~/.ssh/rc) by sshd (permitted by default)."
- "C(no-x11-forwarding): Disable X11 forwarding (permitted by default)"
- "C(permit-agent-forwarding): Allows ssh-agent forwarding."
- "C(permit-port-forwarding): Allows port forwarding."
- "C(permit-pty): Allows PTY allocation."
- "C(permit-user-rc): Allows execution of C(~/.ssh/rc) by sshd."
- "C(permit-x11-forwarding): Allows X11 forwarding."
- "C(source-address=address_list): Restrict the source addresses from which the certificate is considered valid.
The C(address_list) is a comma-separated list of one or more address/netmask pairs in CIDR format."
- "At present, no options are valid for host keys."
type: list
elements: str
identifier:
description:
- Specify the key identity when signing a public key. The identifier that is logged by the server when the certificate is used for authentication.
type: str
serial_number:
description:
- "Specify the certificate serial number.
The serial number is logged by the server when the certificate is used for authentication.
The certificate serial number may be used in a KeyRevocationList.
The serial number may be omitted for checks, but must be specified again for a new certificate.
Note: The default value set by ssh-keygen is 0."
type: int
extends_documentation_fragment: files
s>
# Generate an OpenSSH user certificate that is valid forever and for all users
- openssh_cert:
type: user
signing_key: /path/to/private_key
public_key: /path/to/public_key.pub
path: /path/to/certificate
valid_from: always
valid_to: forever
# Generate an OpenSSH host certificate that is valid for 32 weeks from now and will be regenerated
# if it is valid for less than 2 weeks from the time the module is being run
- openssh_cert:
type: host
signing_key: /path/to/private_key
public_key: /path/to/public_key.pub
path: /path/to/certificate
valid_from: +0s
valid_to: +32w
valid_at: +2w
# Generate an OpenSSH host certificate that is valid forever and only for example.com and examplehost
- openssh_cert:
type: host
signing_key: /path/to/private_key
public_key: /path/to/public_key.pub
path: /path/to/certificate
valid_from: always
valid_to: forever
principals:
- example.com
- examplehost
# Generate an OpenSSH host Certificate that is valid from 21.1.2001 to 21.1.2019
- openssh_cert:
type: host
signing_key: /path/to/private_key
public_key: /path/to/public_key.pub
path: /path/to/certificate
valid_from: "2001-01-21"
valid_to: "2019-01-21"
# Generate an OpenSSH user Certificate with clear and force-command option:
- openssh_cert:
type: user
signing_key: /path/to/private_key
public_key: /path/to/public_key.pub
path: /path/to/certificate
valid_from: always
valid_to: forever
options:
- "clear"
- "force-command=/tmp/bla/foo"
s�
type:
description: type of the certificate (host or user)
returned: changed or success
type: str
sample: host
filename:
description: path to the certificate
returned: changed or success
type: str
sample: /tmp/certificate-cert.pub
info:
description: Information about the certificate. Output of C(ssh-keygen -L -f).
returned: change or success
type: list
elements: str
N( t datetime( t MINYEARt MAXYEAR( t copy2( t rmtree( t
AnsibleModule( t convert_relative_to_datetime( t to_nativet CertificateErrorc B` s e Z RS( ( t __name__t
__module__( ( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyR � s t Certificatec B` sS e Z d � Z d � Z d � Z d � Z d � Z e d � Z d � Z d � Z
RS( c C` s� | j d | _ | j d | _ | j d | _ | j d | _ | j d | _ | j d | _ | j d | _ | j d | _ | j d | _ | j d
| _
| j d | _ | j d | _ | j d
| _
t | _ | j | _ i | _ | j d k rm| j
r(| j d k r(| j d d � n | j rF| j j � | _ n | j j � | _ | j
j � | _
n | j d t � | _ d S( Nt statet forcet typet signing_keyt
public_keyt patht
identifiert
serial_numbert
valid_fromt valid_tot valid_att
principalst optionst presentt hostt msgs0 Options can only be used with user certificates.s
ssh-keygen( t paramsR R R R R R R R R R R R R t Falset changedt
check_modet cert_infot fail_jsont lstript get_bin_patht Truet
ssh_keygen( t selft module( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt __init__� s0 c C` s� | j | d t � s | j rr| j d | j g } d } | j d k oU | j d k s�| j d k s | j | | j � } | t | j � j
d � t | j � j
d � t | j � j
d � t | j
� j
d � t | j � j
d � t | j � j
d � 7} n
| d 7} | d 7} | j d k rAt t d
d � } n | j | | j � } | t | j � j
d � t | j � j
d � t | j � j
d � t | j
� j
d � t | j � j
d � t | j � j
d � 7} | j d | g � n | j d
k r| j d g � n | j r:| j d | j g � n | j d d g � | j d k r{| j d t | j � g � n | j r�| j d d j | j � g � n | j r�x4 | j D]& } | j d g � | j | g � q�Wn | j d d g � y� t j � } t | j | � | j | d t j j | j � g � | j! | d t" d d � d t# �t | d t j j$ t j j | j � � d d | j � t% | d t# �| j! | j d d | j g � } | d j& � | _' t# | _( Wqrt) k
rn} y | j* � t% | d t# �Wn4 t+ k
rP} | j, t, j- k rQt. | � � qQn X| j/ d d! t0 | � � qrXn | j1 | j2 � }
| j3 |
t � r�t# | _( n d S(" Nt perms_requireds -st t alwayst foreveri i t 19700101010101t :i i s -VR" s -hs -Is -zs -nt ,s -Os -Pt /t environ_updatet TZt UTCt check_rci s -cert.pubt
ignore_errorss -Ls -fi R# s %s(4 t is_validR% R R- R R R t convert_to_datetimet strt yeart zfillt montht dayt hourt minutet secondR R
t extendR R R t NoneR t joinR t tempfilet mkdtempR R t osR t basenamet run_commandt dictR, t splitextR t splitR( R& t Exceptiont removet OSErrort errnot ENOENTR R) R t load_file_common_argumentsR$ t set_fs_attributes_if_different( R. R/ t argst validityt timeobjt optiont temp_directoryt proct et exct file_args( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt generate� sn m
m " '";!
!c C` s� | j | � rE t | � } | d k r> | j d d | � q� | Sn\ d d d g } x6 | D]. } y t j | | � SWq[ t k
r� q[ Xq[ W| j d d | � d S( NR# s '%s' is not a valid time format.s %Y-%m-%ds %Y-%m-%d %H:%M:%Ss %Y-%m-%dT%H:%M:%Ss '%s' is not a valid time format( t is_relativeR RI R) R t strptimet
ValueError( R. R/ t
timestringt resultt formatst fmt( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyR? U s
c C` s& | j d � s | j d � r" t St S( Nt +t -( t
startswithR, R% ( R. t timestr( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyRd j s c C` sJ d � } y | | j � d k SWn" t k
rE | | | � d k SXd S( Nc S` s) | j d | j | j d d d d S( Ng i i i
i i@B i@B ( t microsecondst secondst days( t
time_delta( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt timedelta_total_secondsr s g ( t
total_secondst AttributeError( R. t datetime_onet datetime_twoRs ( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt is_same_datetimeo s
c ` s� � f d � } | � r0| j � j d d � j g d t d d � d t �} | d d k rb t S| d j � � _ t j d
| d t j � d j � � t
t t j
� � � � � d g k r� d � n t j d | d � d j
� � t j d
| d � j d � � t j d | d � } | r | d d r�� j | | d d � � � j � � j | d � � r�t t d d � � q�n t t d d � � | d d r�� j | | d d � � � j � � j | d � � rt t d d � � qq-t t d d � � q4t t d d � � t t d d � � n t Sd � } � � f d � } � � f d � } � � f d � } � � � f d � }
| r�| | � r�t S| � o�| � o�|
| � o�| � S( Nc ` s t j j � j � S( N( RM R t exists( ( R. ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt _check_state| s s -Ls -fR9 R: R; R< i i s (?<=Principals:)(.*)(?=Critical)s (none)s ( user | host )s
Serial: (\d+)sS (from (\d{4}-\d{2}-\d{2}T\d{2}(:\d{2}){2}) to (\d{4}-\d{2}-\d{2}T\d{2}(:\d{2}){2}))s 1970-01-01 01:01:01i s 2038-01-19 03:14:07i i c S` s# | j | j � } | j | t � S( N( RX R$ RY R% ( R/ Rb ( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt _check_perms� s c ` s& � j d k r t S� j t � � k S( N( R RI R, t int( ( R. R ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt _check_serial_number� s c ` s
� j � k S( N( R ( ( t cert_typeR. ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt _check_type� s c ` s7 � s � j r � j � k St � j � t � � k S( N( R t set( ( R R. ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt _check_principals� s
c ` s5 � j d k r$ t t d d � } n0 � j � j � r? d } n � j | � j � } � j d k rx t t d d � } n0 � j � j � r� d } n � j | � j � } | r� � j | � � s� t Sn | r� � j | � � s� t Sn � j
r!� � j | � j
� k o� k n r!t Sn | r1| r1t St S( NR3 i R4 i i ( R R R Rd RI R? R R
Rx R% R R, ( R/ t
earliest_timet last_time( t cert_valid_fromt
cert_valid_toR. ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt _check_validity� s, + ( RO R- R RP R% RR R( t ret findallt St listt mapR@ t stripRI t searcht groupR? Rx R R R
( R. R/ R1 Rz R_ R[ R{ R} R R� R� ( ( R~ R� R� R R. R sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyR> z sF 6& c ` so d � � � � f d � } � j d k r[ i � j d 6� j d 6� j d 6| � d 6} n i � j d 6} | S( s' Serialize the object into a dictionary.c S` sk g } d } x> | D]6 } | | k r; | j | � | } q | d | 7} q W| j | � | j d � | S( NR2 t i ( t appendt pop( t arrt keywordst concatedt stringt word( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt filter_keywords� s
c ` s+ � � j d d d d d d d d d g � S(
Ns Type:t Publict Signingt Keys Serial:s Valid:s Principals:t Criticals Extensions:( R( ( ( R� R. ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt format_cert_info� s R! R& R t filenamet info( R R& R R ( R. R� Rh ( ( R� R. sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt dump� s
c C` sX y t j | j � t | _ Wn4 t k
rS } | j t j k rT t | � � qT n Xd S( s( Remove the resource from the filesystem.N( RM RT R R, R& RU RV RW R ( R. Ra ( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyRT s
( R R R0 Rc R? Rd Rx R, R> R� RT ( ( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyR � s Z Z ,c ! ` s� t d t d t d d d d d d d g � d t d d
d t � d t d d d d d g � d
t d d � d t d d � d t d d d t � d t d d � d t d d � d t d d � d t d d � d t d d � d t d d d d � d t d d d d � �
d t d t d d d d d
d d d g f g � � � f d � } � j d d k r| � j d
� | � j d � n | � j d � t � � } | j d k r� j r�� j d p�| j � � | _ q�y | j
� � Wq�t k
r} � j d t
| � � q�Xnw � j rTt j j � j d � | _ | j r�i | _ q�n: y | j � Wn) t k
r�} � j d t
| � � n X| j � } � j | � d S( Nt
argument_specR R R@ t defaultR! t choicest absentR t boolR" t userR R R t requiredR R R| R R R R R� t elementsR t supports_check_modet add_file_common_argst required_ifc ` sK t j j | � p d } t j j | � sG � j d | d d | � n d S( Nt .t nameR# s> The directory %s does not exist or the file is not a directory( RM R t dirnamet isdirR) ( R t base_dir( R/ ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt isBaseDir$ s
R# ( R
RP R% R, R$ R R R' R> R& Rc RS R) R RM R Ry R( RT R� t exit_json( R� t certificateRa Rh ( ( R/ sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt main
sR !$ # t __main__( t
__future__R R R R t
__metaclass__t ANSIBLE_METADATAt
DOCUMENTATIONt EXAMPLESt RETURNRM RV R� RK R R R
t shutilR R t ansible.module_utils.basicR
t ansible.module_utils.cryptoR t ansible.module_utils._textR RS R t objectR R� R ( ( ( sG /usr/lib/python2.7/site-packages/ansible/modules/crypto/openssh_cert.pyt <module> s2
m8 � 4 @
Anons79 File Manager Version 1.0, Coded By Anons79
Email: [email protected]
Anons79 Mini Shell