name : authcompat_Options.py # -*- coding: utf-8 -*- # # Authors: # Pavel Březina <pbrezina@redhat.com> # # Copyright (C) 2018 Red Hat # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for morerequi details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import argparse import gettext _ = gettext.gettext class Option: def __init__(self, name, metavar, help, feature, supported): self.name = name self.metavar = metavar self.help = help self.feature = feature self.supported = supported self.value = None self.from_sysconfig = False def set(self, new_value): self.value = new_value def set_from_sysconfig(self, new_value): self.set(new_value) self.from_sysconfig = True def isset(self): return self.value is not None @staticmethod def Valued(name, metavar, help): return Option(name, metavar, help, feature=False, supported=True) @staticmethod def Switch(name, help): return Option(name, None, help, feature=False, supported=True) @staticmethod def Feature(name, help): return Option(name, None, help, feature=True, supported=True) @staticmethod def UnsupportedValued(name, metavar): return Option(name, metavar, None, feature=False, supported=False) @staticmethod def UnsupportedFeature(name): return Option(name, None, None, feature=True, supported=False) @staticmethod def UnsupportedSwitch(name): return Option(name, None, None, feature=False, supported=False) class Options: List = [ # These options are still supported in authconfig compatibility # layers. The tool will do its best to translate them to authselect # call and where needed, it will generate a configuration file. # # However, they will just make sure that an authentication against # expected service is working. They may not result in the exact same # configuration as authconfig would generate. Option.Feature("nis", _("NIS for user information by default")), Option.Valued("nisdomain", _("<domain>"), _("default NIS domain")), Option.Valued("nisserver", _("<server>"), _("default NIS server")), Option.Feature("ldap", _("LDAP for user information by default")), Option.Feature("ldapauth", _("LDAP for authentication by default")), Option.Valued("ldapserver", _("<server>"), _("default LDAP server hostname or URI")), Option.Valued("ldapbasedn", _("<dn>"), _("default LDAP base DN")), Option.Feature("ldaptls", _("use of TLS with LDAP (RFC-2830)")), Option.Feature("ldapstarttls", _("use of TLS for identity lookups with LDAP (RFC-2830)")), Option.Feature("rfc2307bis", _("use of RFC-2307bis schema for LDAP user information lookups")), Option.Feature("smartcard", _("authentication with smart card by default")), Option.Valued("smartcardaction", _("<0=Lock|1=Ignore>"), _("action to be taken on smart card removal")), Option.Feature("requiresmartcard", _("require smart card for authentication by default")), Option.Feature("fingerprint", _("authentication with fingerprint readers by default")), Option.Feature("krb5", _("Kerberos authentication by default")), Option.Valued("krb5kdc", _("<server>"), _("default Kerberos KDC")), Option.Valued("krb5adminserver", _("<server>"), _("default Kerberos admin server")), Option.Valued("krb5realm", _("<realm>"), _("default Kerberos realm")), Option.Feature("krb5kdcdns", _("use of DNS to find Kerberos KDCs")), Option.Feature("krb5realmdns", _("use of DNS to find Kerberos realms")), Option.Feature("winbind", _("winbind for user information by default")), Option.Feature("winbindauth", _("winbind for authentication by default")), Option.Valued("winbindjoin", _("<Administrator>"), _("join the winbind domain or ads realm now as this administrator")), Option.Feature("winbindkrb5", _("Kerberos 5 for authenticate with winbind")), Option.Valued("smbworkgroup", _("<workgroup>"), _("workgroup authentication servers are in")), Option.Feature("sssd", _("SSSD for user information by default with manually managed configuration")), Option.Feature("sssdauth", _("SSSD for authentication by default with manually managed configuration")), Option.Feature("cachecreds", _("caching of user credentials in SSSD by default")), Option.Feature("pamaccess", _("check of access.conf during account authorization")), Option.Feature("mkhomedir", _("creation of home directories for users on their first login")), Option.Feature("faillock", _("account locking in case of too many consecutive authentication failures")), Option.Valued("passminlen", _("<number>"), _("minimum length of a password")), Option.Valued("passminclass", _("<number>"), _("minimum number of character classes in a password")), Option.Valued("passmaxrepeat", _("<number>"), _("maximum number of same consecutive characters in a password")), Option.Valued("passmaxclassrepeat", _("<number>"), _("maximum number of consecutive characters of same class in a password")), Option.Feature("reqlower", _("require at least one lowercase character in a password")), Option.Feature("requpper", _("require at least one uppercase character in a password")), Option.Feature("reqdigit", _("require at least one digit in a password")), Option.Feature("reqother", _("require at least one other character in a password")), # Program options Option.Switch("nostart", _("do not start/stop services")), Option.Switch("updateall", _("update all configuration files")), Option.Switch("update", _("the same as --updateall")), Option.Switch("kickstart", _("the same as --updateall")), # Hidden compat tool option, useful for testing. No changes to the # system will be done, they will be printed. Option.Switch("test-call", argparse.SUPPRESS), # Unsupported program options but we have to react somehow when set Option.UnsupportedSwitch("test"), Option.UnsupportedSwitch("probe"), Option.UnsupportedValued("savebackup", _("<name>")), Option.UnsupportedValued("restorebackup", _("<name>")), Option.UnsupportedSwitch("restorelastbackup"), # These options are no longer supported in authconfig compatibility # layers and will produce warning when used. They will not affect # the system. Option.UnsupportedFeature("cache"), Option.UnsupportedFeature("ecryptfs"), Option.UnsupportedFeature("shadow"), Option.UnsupportedSwitch("useshadow"), Option.UnsupportedFeature("md5"), Option.UnsupportedSwitch("usemd5"), Option.UnsupportedValued("passalgo", _("<descrypt|bigcrypt|md5|sha256|sha512>")), Option.UnsupportedValued("ldaploadcacert", _("<URL>")), Option.UnsupportedValued("smartcardmodule", _("<module>")), Option.UnsupportedValued("smbsecurity", _("<user|server|domain|ads>")), Option.UnsupportedValued("smbrealm", _("<realm>")), Option.UnsupportedValued("smbservers", _("<servers>")), Option.UnsupportedValued("smbidmaprange", _("<lowest-highest>")), Option.UnsupportedValued("smbidmapuid", _("<lowest-highest>")), Option.UnsupportedValued("smbidmapgid", _("<lowest-highest>")), Option.UnsupportedValued("winbindseparator", _("<\\>")), Option.UnsupportedValued("winbindtemplatehomedir", _("</home/%D/%U>")), Option.UnsupportedValued("winbindtemplateshell", _("</bin/false>")), Option.UnsupportedFeature("winbindusedefaultdomain"), Option.UnsupportedFeature("winbindoffline"), Option.UnsupportedFeature("preferdns"), Option.UnsupportedFeature("forcelegacy"), Option.UnsupportedFeature("locauthorize"), Option.UnsupportedFeature("sysnetauth"), Option.UnsupportedValued("faillockargs", _("<options>")), ] Map = { # These options were use with autodetection of pam_cracklib # and pam_passwdqc. However, authselect supports only pam_pwquality. # "USEPWQUALITY" : "", # "USEPASSWDQC" : "", "USEFAILLOCK": "faillock", "FAILLOCKARGS": "faillockargs", "USELDAP": "ldap", "USENIS": "nis", "USEECRYPTFS": "ecryptfs", "USEWINBIND": "winbind", "WINBINDKRB5": "winbindkrb5", "USESSSD": "sssd", "USEKERBEROS": "krb5", "USELDAPAUTH": "ldapauth", "USESMARTCARD": "smartcard", "FORCESMARTCARD": "requiresmartcard", "USEFPRINTD": "fingerprint", "PASSWDALGORITHM": "passalgo", "USEMD5": "md5", "USESHADOW": "shadow", "USEWINBINDAUTH": "winbindauth", "USESSSDAUTH": "sssdauth", "USELOCAUTHORIZE": "locauthorize", "USEPAMACCESS": "pamaccess", "USEMKHOMEDIR": "mkhomedir", "USESYSNETAUTH": "sysnetauth", "FORCELEGACY": "forcelegacy", "CACHECREDENTIALS": "cachecreds", } def __init__(self): self.options = {} for option in self.List: self.options[option.name] = option def parse(self): parser = argparse.ArgumentParser(description='Authconfig Compatibility Tool.') parsers = { 'supported': parser.add_argument_group(_('These options have a compatibility layer')), 'unsupported': parser.add_argument_group(_('These options are no longer supported and have no effect')) } for option in self.List: group = 'supported' if option.supported else 'unsupported' self.add_option(parsers[group], option) cmdline = parser.parse_args() for name, option in self.options.items(): value = getattr(cmdline, name) option.set(value) # usemd5 and useshadow are equivalent to enablemd5 and enableshadow if not self.isset('md5') and self.isset('usemd5'): self.set('md5', self.get('usemd5')) if not self.isset('shadow') and self.isset('useshadow'): self.set('shadow', self.get('useshadow')) # ldapstarttls is equivalent to ldaptls if self.isset('ldapstarttls') and not self.isset('ldaptls'): self.set('ldaptls', self.get('ldapstarttls')) def applysysconfig(self, sysconfig): for name, option in self.Map.items(): if not self.isset(option): self.options[option].set_from_sysconfig(sysconfig.get(name)) def updatesysconfig(self, sysconfig): for name, option in self.Map.items(): if self.isset(option): sysconfig.set(name, self.get(option)) def get(self, name): return self.options[name].value def set(self, name, value): self.options[name].set(value) def isset(self, name): return self.options[name].isset() def getBool(self, name): value = self.get(name) if value is None or not value: return False return True def getTrueOrNone(self, name): value = self.get(name) if value is None or not value: return None return True def getSetButUnsupported(self): options = [] for option in Options.List: if option.supported: continue if not option.isset(): continue if option.from_sysconfig: continue name = option.name if option.feature: name = "enable" + name if option.value else "disable" + name options.append(name) return options def add_option(self, parser, option): if option.metavar is not None: self.add_valued(parser, option) elif option.feature: self.add_feature(parser, option) else: self.add_switch(parser, option) def add_valued(self, parser, option): parser.add_argument("--" + option.name, action='store', help=option.help, dest=option.name, metavar=option.metavar) def add_switch(self, parser, option): parser.add_argument("--" + option.name, action='store_const', const=True, help=option.help, dest=option.name) def add_feature(self, parser, option): help_enable = None help_disable = None if option.help is not None: help_enable = _("enable") + " " + option.help help_disable = _("disable") + " " + option.help parser.add_argument("--enable" + option.name, action='store_const', const=True, help=help_enable, dest=option.name) parser.add_argument("--disable" + option.name, action='store_const', const=False, help=help_disable, dest=option.name)