|
|
#-*- coding: utf-8 -*-
|
|
|
|
|
|
# Copyright 2008-2010 Calculate Ltd. http://www.calculate-linux.org
|
|
|
#
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
# you may not use this file except in compliance with the License.
|
|
|
# You may obtain a copy of the License at
|
|
|
#
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
#
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
# See the License for the specific language governing permissions and
|
|
|
# limitations under the License.
|
|
|
|
|
|
import sys
|
|
|
import os
|
|
|
import hashlib
|
|
|
import crypt
|
|
|
import string
|
|
|
import time
|
|
|
from random import choice
|
|
|
from base64 import encodestring as _b64enc
|
|
|
b64encode = lambda x: _b64enc(x).rstrip()
|
|
|
try:
|
|
|
from smbpasswd import lmhash,nthash
|
|
|
except ImportError:
|
|
|
lmhash,nthash = None,None
|
|
|
from cl_print import color_print
|
|
|
# для создания сертификата
|
|
|
import pwd
|
|
|
from server.utils import execProg
|
|
|
import cl_overriding
|
|
|
import cl_lang
|
|
|
from cl_utils import genpassword, removeDir
|
|
|
|
|
|
# Перевод модуля
|
|
|
tr = cl_lang.lang()
|
|
|
tr.setLocalDomain('cl_lib')
|
|
|
tr.setLanguage(sys.modules[__name__])
|
|
|
|
|
|
class encrypt(color_print):
|
|
|
"""Класс хранения общих методов используемых для настройки сервисов
|
|
|
|
|
|
Методы шифрования, создания сертификатов и.т. д
|
|
|
"""
|
|
|
|
|
|
def __GenCryptSalt__(self, len=2):
|
|
|
"""Генерация соли для хеширования пароля (CRYPT)"""
|
|
|
chars = string.letters + string.digits + "./"
|
|
|
salt = ""
|
|
|
for i in range(len):
|
|
|
salt = salt + choice(chars)
|
|
|
return salt
|
|
|
|
|
|
def getHashPasswd(self, password, SecHashAlg):
|
|
|
"""Генерация хеша пароля,
|
|
|
|
|
|
Поддерживаемые алгоритмы шифрования пароля:
|
|
|
plain, md5, smd5, crypt, sha, ssha, lm, nt, shadow_ssha512,
|
|
|
shadow_ssha256, shadow_md5
|
|
|
"""
|
|
|
if not password:
|
|
|
self.printERROR(_("ERROR") + " getHashPasswd: " +
|
|
|
_("empty password"))
|
|
|
return False
|
|
|
|
|
|
hashPwd = ""
|
|
|
if SecHashAlg == "plain":
|
|
|
hashPwd = password
|
|
|
|
|
|
elif SecHashAlg == "md5":
|
|
|
h = hashlib.md5(password)
|
|
|
hashPwd = "{MD5}" + b64encode(h.digest())
|
|
|
|
|
|
elif SecHashAlg == "smd5":
|
|
|
salt = os.urandom(4)
|
|
|
h = hashlib.md5(password)
|
|
|
h.update(salt)
|
|
|
hashPwd = "{SMD5}" + b64encode(h.digest() + salt)
|
|
|
|
|
|
elif SecHashAlg == "shadow_ssha512":
|
|
|
salt = self.__GenCryptSalt__(8)
|
|
|
hashPwd = crypt.crypt(password, "$6$%s$"%salt)
|
|
|
|
|
|
elif SecHashAlg == "shadow_ssha256":
|
|
|
salt = self.__GenCryptSalt__(8)
|
|
|
hashPwd = crypt.crypt(password, "$5$%s$"%salt)
|
|
|
|
|
|
elif SecHashAlg == "shadow_md5":
|
|
|
salt = self.__GenCryptSalt__(8)
|
|
|
hashPwd = crypt.crypt(password, "$1$%s$"%salt)
|
|
|
|
|
|
elif SecHashAlg == "crypt":
|
|
|
salt = self.__GenCryptSalt__()
|
|
|
hashPwd = "{CRYPT}" + crypt.crypt(password, salt)
|
|
|
|
|
|
elif SecHashAlg == "sha":
|
|
|
h = hashlib.sha1(password)
|
|
|
hashPwd = "{SHA}" + b64encode(h.digest())
|
|
|
|
|
|
elif SecHashAlg == "ssha":
|
|
|
salt = os.urandom(4)
|
|
|
h = hashlib.sha1(password)
|
|
|
h.update(salt)
|
|
|
hashPwd = "{SSHA}" + b64encode(h.digest() + salt)
|
|
|
|
|
|
elif SecHashAlg == "lm" and lmhash:
|
|
|
hashPwd = lmhash(password)
|
|
|
elif SecHashAlg == "nt" and nthash:
|
|
|
hashPwd = nthash(password)
|
|
|
else:
|
|
|
if SecHashAlg in ("lm","nt"):
|
|
|
self.printERROR(_("ERROR") + " getHashPasswd: " +
|
|
|
(_("Failed to support '%s' crypto algorithm")
|
|
|
%SecHashAlg) + " " + _("without py-smbpasswd"))
|
|
|
else:
|
|
|
self.printERROR(_("ERROR") + " getHashPasswd: " +
|
|
|
_("Failed to support '%s' crypto algorithm")
|
|
|
%SecHashAlg)
|
|
|
return False
|
|
|
return hashPwd
|
|
|
|
|
|
|
|
|
class certificate(color_print):
|
|
|
sslCountry = "RU"
|
|
|
sslState = "Saint-Petersburg"
|
|
|
sslLocality = "Saint-Petersburg"
|
|
|
sslOrganization = "Calculate Ltd."
|
|
|
sslUnit = "SSL"
|
|
|
sslCommonName = "localhost"
|
|
|
sslEmail = "support@calculate.ru"
|
|
|
nsCertType = "server"
|
|
|
sslDays = 3653
|
|
|
sslBits = 1024
|
|
|
userName = "root"
|
|
|
fileMode = 0400
|
|
|
certsDir = "/var/calculate/ssl"
|
|
|
tmpDir = os.path.join(certsDir,"tmp")
|
|
|
certFile = os.path.join(tmpDir, "server.crt")
|
|
|
keyFile = os.path.join(tmpDir, "server.key")
|
|
|
csrFile = os.path.join(tmpDir, "server.csr")
|
|
|
|
|
|
CAPath = os.path.join(certsDir,"main")
|
|
|
CACertFileName = "CA.crt"
|
|
|
CAKeyFileName = "CA.key"
|
|
|
CACrlFileName = "CA.crl"
|
|
|
rCACertPath = "crt"
|
|
|
rCAKeyPath = "key"
|
|
|
rCACrlPath = "crl"
|
|
|
rSerialFileName = "serial"
|
|
|
rDatabaseFileName = "index.dat"
|
|
|
|
|
|
sslFile = "/usr/bin/openssl"
|
|
|
|
|
|
templCnfCA = """[ ca ]
|
|
|
default_ca = CA_default
|
|
|
|
|
|
[ CA_default ]
|
|
|
dir = %(CAPath)s
|
|
|
certs = $dir/%(rCACertPath)s
|
|
|
crl_dir = $dir/%(rCACrlPath)s
|
|
|
database = $dir/%(rDatabaseFileName)s
|
|
|
new_certs_dir = $dir/%(rCACertPath)s
|
|
|
certificate = $dir/%(rCACertFile)s
|
|
|
serial = $dir/%(rSerialFileName)s
|
|
|
crlnumber = $dir/crlnumber
|
|
|
crl = $dir/%(rCACrlFile)s
|
|
|
private_key = $dir/%(rCAKeyFile)s
|
|
|
RANDFILE = $dir/%(rRandFile)s
|
|
|
|
|
|
x509_extensions = usr_cert
|
|
|
name_opt = ca_default
|
|
|
cert_opt = ca_default
|
|
|
default_days = 365
|
|
|
default_crl_days= 30
|
|
|
default_md = default
|
|
|
preserve = no
|
|
|
policy = policy_match
|
|
|
|
|
|
[ policy_match ]
|
|
|
countryName = match
|
|
|
stateOrProvinceName = match
|
|
|
organizationName = match
|
|
|
organizationalUnitName = optional
|
|
|
commonName = supplied
|
|
|
emailAddress = optional
|
|
|
|
|
|
[ policy_anything ]
|
|
|
countryName = optional
|
|
|
stateOrProvinceName = optional
|
|
|
localityName = optional
|
|
|
organizationName = optional
|
|
|
organizationalUnitName = optional
|
|
|
commonName = supplied
|
|
|
emailAddress = optional
|
|
|
|
|
|
[ usr_cert ]
|
|
|
basicConstraints=CA:FALSE
|
|
|
subjectKeyIdentifier=hash
|
|
|
authorityKeyIdentifier=keyid,issuer
|
|
|
|
|
|
[ req ]
|
|
|
prompt = no
|
|
|
default_bits = %(sslBits)s
|
|
|
x509_extensions = v3_ca
|
|
|
string_mask = utf8only
|
|
|
distinguished_name = req_dn
|
|
|
|
|
|
[ req_dn ]
|
|
|
C = %(sslCountry)s
|
|
|
ST = %(sslState)s
|
|
|
L = %(sslLocality)s
|
|
|
O = %(sslOrganization)s
|
|
|
OU = %(sslUnit)s
|
|
|
CN = %(sslCommonName)s
|
|
|
emailAddress = %(sslEmail)s
|
|
|
|
|
|
[ cert_type ]
|
|
|
nsCertType = %(nsCertType)s
|
|
|
|
|
|
[ v3_ca ]
|
|
|
subjectKeyIdentifier=hash
|
|
|
authorityKeyIdentifier=keyid:always,issuer
|
|
|
basicConstraints = CA:true
|
|
|
"""
|
|
|
templCnfData = """[ req ]
|
|
|
prompt = no
|
|
|
default_bits = %(sslBits)s
|
|
|
distinguished_name = req_dn
|
|
|
|
|
|
[ req_dn ]
|
|
|
C = %(sslCountry)s
|
|
|
ST = %(sslState)s
|
|
|
L = %(sslLocality)s
|
|
|
O = %(sslOrganization)s
|
|
|
OU = %(sslUnit)s
|
|
|
CN = %(sslCommonName)s
|
|
|
emailAddress = %(sslEmail)s
|
|
|
|
|
|
[ cert_type ]
|
|
|
nsCertType = %(nsCertType)s
|
|
|
"""
|
|
|
|
|
|
templCreateKey = "%(sslFile)s genrsa -out '%(certKeyFile)s' %(sslBits)s"
|
|
|
templCreateCert = "%(sslFile)s req -new -x509 -days %(sslDays)s "\
|
|
|
"-config '%(cnfFile)s' -key '%(certKeyFile)s' "\
|
|
|
"-out '%(certFile)s'"
|
|
|
templCreateReq = "%(sslFile)s req -new -days %(sslDays)s "\
|
|
|
"-config '%(cnfFile)s' -key '%(certKeyFile)s' "\
|
|
|
"-out '%(certCsrFile)s'"
|
|
|
templCreateSignCert = "%(sslFile)s ca -batch -config '%(cnfFile)s' "\
|
|
|
"-policy policy_anything -days '%(sslDays)s' "\
|
|
|
"-out '%(certFile)s' -infiles '%(certCsrFile)s'"
|
|
|
|
|
|
def createCnfFile(self, textCnf):
|
|
|
'''Generate openssl.cnf file'''
|
|
|
if not os.path.exists(self.sslFile):
|
|
|
self.printERROR(_("%s not found")%self.sslFile)
|
|
|
return False
|
|
|
strData = time.strftime("%Y%m%d%H%M%S",time.localtime(time.time()))
|
|
|
cnfFileName = "%s.%s.cnf" %(strData,genpassword())
|
|
|
if not os.path.exists(self.tmpDir):
|
|
|
self._createDir(self.tmpDir)
|
|
|
cnfFile = os.path.join(self.tmpDir,cnfFileName)
|
|
|
self._createFile(cnfFile, textCnf)
|
|
|
return cnfFile
|
|
|
|
|
|
def checkCertificate(self, certFile):
|
|
|
# Проверка сертификата
|
|
|
textLine = execProg("%s x509 -subject -fingerprint -noout -in '%s'"
|
|
|
%(self.sslFile, certFile))
|
|
|
if textLine is False:
|
|
|
self.printERROR(_("Error checking certificate %s")%certFile)
|
|
|
return False
|
|
|
return True
|
|
|
|
|
|
def createCertificateAutority(self,sslCountry=sslCountry,
|
|
|
sslState=sslState,
|
|
|
sslLocality=sslLocality,
|
|
|
sslOrganization=sslOrganization,
|
|
|
sslUnit=sslUnit,
|
|
|
sslCommonName=sslCommonName,
|
|
|
sslEmail=sslEmail,
|
|
|
nsCertType=nsCertType,
|
|
|
sslDays=sslDays,
|
|
|
sslBits=sslBits,
|
|
|
userName=userName,
|
|
|
CAPath=CAPath,
|
|
|
CACertFileName=CACertFileName,
|
|
|
CAKeyFileName=CAKeyFileName,
|
|
|
CACrlFileName=CACrlFileName,
|
|
|
fileMode=fileMode,
|
|
|
force=False):
|
|
|
'''Create CA'''
|
|
|
rCACertFile = os.path.join(self.rCACertPath, CACertFileName)
|
|
|
rCAKeyFile = os.path.join(self.rCAKeyPath, CAKeyFileName)
|
|
|
rCACrlFile = os.path.join(self.rCACrlPath, CACrlFileName)
|
|
|
rRandFile = os.path.join(self.rCAKeyPath,".rnd")
|
|
|
|
|
|
CACertFile = os.path.join(CAPath, rCACertFile)
|
|
|
CAKeyFile = os.path.join(CAPath, rCAKeyFile)
|
|
|
# Cerificates exists
|
|
|
if not force and os.path.isfile(CACertFile) and\
|
|
|
os.path.isfile(CAKeyFile):
|
|
|
return True
|
|
|
# получаем id и gid пользователя
|
|
|
try:
|
|
|
pwdObj = pwd.getpwnam(userName)
|
|
|
except:
|
|
|
self.printERROR(_("User %s not found")%userName)
|
|
|
return False
|
|
|
uid = pwdObj.pw_uid
|
|
|
gid = pwdObj.pw_gid
|
|
|
# delete certificate dir
|
|
|
if os.path.isdir(CAPath):
|
|
|
removeDir(CAPath)
|
|
|
# create certificate dirs
|
|
|
self._createDir(CAPath)
|
|
|
CACertPath = os.path.join(CAPath, self.rCACertPath)
|
|
|
CAKeyPath = os.path.join(CAPath, self.rCAKeyPath)
|
|
|
CACrlPath = os.path.join(CAPath, self.rCACrlPath)
|
|
|
for createDir in [CACertPath, CAKeyPath, CACrlPath]:
|
|
|
self._createDir(createDir)
|
|
|
# save serial number
|
|
|
SerialFile = os.path.join(CAPath, self.rSerialFileName)
|
|
|
self._createFile(SerialFile, "01\n")
|
|
|
# create database file
|
|
|
DatabaseFile = os.path.join(CAPath, self.rDatabaseFileName)
|
|
|
self._createFile(DatabaseFile, "")
|
|
|
textCnf = self.templCnfCA%{'CAPath':CAPath,
|
|
|
'rCACertPath':self.rCACertPath,
|
|
|
'rCACrlPath':self.rCACrlPath,
|
|
|
'rDatabaseFileName':self.rDatabaseFileName,
|
|
|
'rCACertFile':rCACertFile,
|
|
|
'rSerialFileName':self.rSerialFileName,
|
|
|
'rCACrlFile':rCACrlFile,
|
|
|
'rCAKeyFile':rCAKeyFile,
|
|
|
'rRandFile':rRandFile,
|
|
|
'sslBits':sslBits,
|
|
|
'sslCountry':sslCountry,
|
|
|
'sslState':sslState,
|
|
|
'sslLocality':sslLocality,
|
|
|
'sslOrganization':sslOrganization,
|
|
|
'sslUnit':sslUnit,
|
|
|
'sslCommonName':sslCommonName,
|
|
|
'sslEmail':sslEmail,
|
|
|
'nsCertType':nsCertType}
|
|
|
cnfFile = self.createCnfFile(textCnf)
|
|
|
if cnfFile is False:
|
|
|
return False
|
|
|
# generate CA RSA key
|
|
|
execStr = self.templCreateKey%{'sslFile':self.sslFile,
|
|
|
'certKeyFile':CAKeyFile,
|
|
|
'sslBits':sslBits}
|
|
|
if execProg(execStr) is False:
|
|
|
self.printERROR(_("Can not execute '%s'")%execStr)
|
|
|
return False
|
|
|
if os.path.exists(CAKeyFile):
|
|
|
os.chown(CAKeyFile, uid,gid)
|
|
|
os.chmod(CAKeyFile, fileMode)
|
|
|
# create CA
|
|
|
execStr = self.templCreateCert%{'sslFile':self.sslFile,
|
|
|
'sslDays':sslDays,
|
|
|
'cnfFile':cnfFile,
|
|
|
'certKeyFile':CAKeyFile,
|
|
|
'certFile':CACertFile}
|
|
|
if execProg(execStr) is False:
|
|
|
self.printERROR(_("Can not execute '%s'")%execStr)
|
|
|
return False
|
|
|
if os.path.exists(CACertFile):
|
|
|
os.chown(CACertFile, uid,gid)
|
|
|
os.chmod(CACertFile, fileMode)
|
|
|
if os.path.exists(cnfFile):
|
|
|
os.remove(cnfFile)
|
|
|
# check certificate
|
|
|
return self.checkCertificate(CACertFile)
|
|
|
|
|
|
def createSignedCertificate(self,
|
|
|
sslCountry=sslCountry,
|
|
|
sslState=sslState,
|
|
|
sslLocality=sslLocality,
|
|
|
sslOrganization=sslOrganization,
|
|
|
sslUnit=sslUnit,
|
|
|
sslCommonName=sslCommonName,
|
|
|
sslEmail=sslEmail,
|
|
|
nsCertType=nsCertType,
|
|
|
sslDays=sslDays,
|
|
|
sslBits=sslBits,
|
|
|
userName=userName,
|
|
|
CAPath=CAPath,
|
|
|
CACertFileName=CACertFileName,
|
|
|
CAKeyFileName=CAKeyFileName,
|
|
|
CACrlFileName=CACrlFileName,
|
|
|
certFile=certFile,
|
|
|
fileMode=fileMode,
|
|
|
keyFile=keyFile,
|
|
|
csrFile=csrFile,
|
|
|
force=False):
|
|
|
'''Create signed CA certificate'''
|
|
|
certAndKeyFiles = [certFile, keyFile, csrFile]
|
|
|
foundCertFiles = map(lambda x: os.path.exists(x), certAndKeyFiles)
|
|
|
if not force and foundCertFiles[0] and foundCertFiles[1]:
|
|
|
return True
|
|
|
foundCertFiles = map(lambda x: x[1], filter(lambda x: x[0],
|
|
|
zip(foundCertFiles, certAndKeyFiles)))
|
|
|
# Удаляем файлы
|
|
|
map(lambda x: os.remove(x), foundCertFiles)
|
|
|
# получаем id и gid пользователя
|
|
|
try:
|
|
|
pwdObj = pwd.getpwnam(userName)
|
|
|
except:
|
|
|
self.printERROR(_("User %s not found")%userName)
|
|
|
return False
|
|
|
uid = pwdObj.pw_uid
|
|
|
gid = pwdObj.pw_gid
|
|
|
# create dirs
|
|
|
for fileName in certAndKeyFiles:
|
|
|
dirName = os.path.split(fileName)[0]
|
|
|
if not os.path.exists(dirName):
|
|
|
self._createDir(dirName, uid=uid, gid=gid)
|
|
|
rCACertFile = os.path.join(self.rCACertPath, CACertFileName)
|
|
|
rCAKeyFile = os.path.join(self.rCAKeyPath, CAKeyFileName)
|
|
|
rCACrlFile = os.path.join(self.rCACrlPath, CACrlFileName)
|
|
|
rRandFile = os.path.join(self.rCAKeyPath,".rnd")
|
|
|
textCnf = self.templCnfCA%{'CAPath':CAPath,
|
|
|
'rCACertPath':self.rCACertPath,
|
|
|
'rCACrlPath':self.rCACrlPath,
|
|
|
'rDatabaseFileName':self.rDatabaseFileName,
|
|
|
'rCACertFile':rCACertFile,
|
|
|
'rSerialFileName':self.rSerialFileName,
|
|
|
'rCACrlFile':rCACrlFile,
|
|
|
'rCAKeyFile':rCAKeyFile,
|
|
|
'rRandFile':rRandFile,
|
|
|
'sslBits':sslBits,
|
|
|
'sslCountry':sslCountry,
|
|
|
'sslState':sslState,
|
|
|
'sslLocality':sslLocality,
|
|
|
'sslOrganization':sslOrganization,
|
|
|
'sslUnit':sslUnit,
|
|
|
'sslCommonName':sslCommonName,
|
|
|
'sslEmail':sslEmail,
|
|
|
'nsCertType':nsCertType}
|
|
|
cnfFile = self.createCnfFile(textCnf)
|
|
|
if cnfFile is False:
|
|
|
return False
|
|
|
# generate RSA key
|
|
|
execStr = self.templCreateKey%{'sslFile':self.sslFile,
|
|
|
'certKeyFile':keyFile,
|
|
|
'sslBits':sslBits}
|
|
|
if execProg(execStr) is False:
|
|
|
self.printERROR(_("Can not execute '%s'")%execStr)
|
|
|
return False
|
|
|
if os.path.exists(keyFile):
|
|
|
os.chown(keyFile, uid,gid)
|
|
|
os.chmod(keyFile, fileMode)
|
|
|
# generate request
|
|
|
execStr = self.templCreateReq%{'sslFile':self.sslFile,
|
|
|
'sslDays':sslDays,
|
|
|
'cnfFile':cnfFile,
|
|
|
'certKeyFile':keyFile,
|
|
|
'certCsrFile':csrFile}
|
|
|
if execProg(execStr) is False:
|
|
|
self.printERROR(_("Can not execute '%s'")%execStr)
|
|
|
return False
|
|
|
if os.path.exists(csrFile):
|
|
|
os.chown(csrFile, uid,gid)
|
|
|
os.chmod(csrFile, fileMode)
|
|
|
# set database attribute
|
|
|
databaseAttrFileName = os.path.join(CAPath, "index.dat.attr")
|
|
|
self._createFile(databaseAttrFileName, "unique_subject = no\n")
|
|
|
# generate signed cerificate
|
|
|
execStr = self.templCreateSignCert%{'sslFile':self.sslFile,
|
|
|
'sslDays':sslDays,
|
|
|
'cnfFile':cnfFile,
|
|
|
'certFile':certFile,
|
|
|
'certCsrFile':csrFile}
|
|
|
if execProg(execStr) is False:
|
|
|
self.printERROR(_("Can not execute '%s'")%execStr)
|
|
|
return False
|
|
|
if os.path.exists(certFile):
|
|
|
os.chown(certFile, uid,gid)
|
|
|
os.chmod(certFile, fileMode)
|
|
|
if os.path.exists(cnfFile):
|
|
|
os.remove(cnfFile)
|
|
|
# check certificate
|
|
|
return self.checkCertificate(certFile)
|
|
|
|
|
|
def createCertificate(self,
|
|
|
sslCountry=sslCountry,
|
|
|
sslState=sslCountry,
|
|
|
sslLocality=sslLocality,
|
|
|
sslOrganization=sslOrganization,
|
|
|
sslUnit=sslUnit,
|
|
|
sslCommonName=sslCommonName,
|
|
|
sslEmail=sslEmail,
|
|
|
nsCertType=nsCertType,
|
|
|
sslDays=sslDays,
|
|
|
sslBits=sslBits,
|
|
|
userName=userName,
|
|
|
certFile=certFile,
|
|
|
fileMode=fileMode,
|
|
|
keyFile=keyFile):
|
|
|
"""Создает сертификат"""
|
|
|
certAndKeyFiles = [certFile, keyFile]
|
|
|
foundCertFiles = filter(lambda x: os.path.exists(x), certAndKeyFiles)
|
|
|
if len(foundCertFiles)==2:
|
|
|
return True
|
|
|
# Удаляем файл сертификата
|
|
|
map(lambda x: os.remove(x), foundCertFiles)
|
|
|
# получаем id и gid пользователя
|
|
|
try:
|
|
|
pwdObj = pwd.getpwnam(userName)
|
|
|
except:
|
|
|
self.printERROR(_("User %s not found")%userName)
|
|
|
return False
|
|
|
uid = pwdObj.pw_uid
|
|
|
gid = pwdObj.pw_gid
|
|
|
textCnf=self.templCnfData%{'sslBits':sslBits,
|
|
|
'sslCountry':sslCountry,
|
|
|
'sslState':sslState,
|
|
|
'sslLocality':sslLocality,
|
|
|
'sslOrganization':sslOrganization,
|
|
|
'sslUnit':sslUnit,
|
|
|
'sslCommonName':sslCommonName,
|
|
|
'sslEmail':sslEmail,
|
|
|
'nsCertType':nsCertType}
|
|
|
cnfFile = self.createCnfFile(textCnf)
|
|
|
if cnfFile is False:
|
|
|
return False
|
|
|
# Cоздание директорий
|
|
|
for fileName in certAndKeyFiles:
|
|
|
dirName = os.path.split(fileName)[0]
|
|
|
if not os.path.exists(dirName):
|
|
|
self._createDir(dirName, uid=uid, gid=gid)
|
|
|
# Создание сертификата
|
|
|
textLine = execProg("%s req -new -x509 -nodes -config '%s'"
|
|
|
"-days %s -out '%s'-keyout '%s'"
|
|
|
%(self.sslFile, cnfFile, sslDays, certFile,
|
|
|
keyFile))
|
|
|
if textLine is False:
|
|
|
self.printERROR(_("Failed to create certificate %s")%certFile)
|
|
|
return False
|
|
|
# Удаление конфигурационного файла
|
|
|
if os.path.exists(cnfFile):
|
|
|
os.remove(cnfFile)
|
|
|
# Меняем права
|
|
|
if os.path.exists(certFile):
|
|
|
os.chown(certFile, uid,gid)
|
|
|
os.chmod(certFile, fileMode)
|
|
|
if os.path.exists(keyFile):
|
|
|
os.chown(keyFile, uid,gid)
|
|
|
os.chmod(keyFile, fileMode)
|
|
|
|
|
|
return self.checkCertificate(certFile)
|
|
|
|
|
|
def _createDir(self, dirName, uid=0, gid=0, mode=0700):
|
|
|
"""Создание пользовательской директории"""
|
|
|
if not os.path.exists(dirName):
|
|
|
os.makedirs(dirName)
|
|
|
if mode:
|
|
|
os.chmod(dirName,mode)
|
|
|
os.chown(dirName,uid,gid)
|
|
|
return True
|
|
|
else:
|
|
|
self.printERROR(_("Path %s exists") %dirName)
|
|
|
return False
|
|
|
|
|
|
def _createFile(self, fileName, fileTxt, uid=0, gid=0, mode=0600):
|
|
|
"""Создает пользовательский файл с содержимым
|
|
|
|
|
|
Если директория файла не существует то ошибка
|
|
|
"""
|
|
|
dirName = os.path.split(fileName)[0]
|
|
|
if not os.path.exists(dirName):
|
|
|
self.printERROR(_("Path %s does not exist") %dirName)
|
|
|
return False
|
|
|
fd = os.open(fileName, os.O_CREAT)
|
|
|
os.close(fd)
|
|
|
os.chmod(fileName, 0600)
|
|
|
os.chown(fileName,uid,gid)
|
|
|
if fileTxt:
|
|
|
FD = open(fileName, "r+")
|
|
|
FD.write(fileTxt)
|
|
|
FD.close()
|
|
|
os.chmod(fileName, mode)
|
|
|
return True
|
|
|
|
|
|
|
|
|
def getHash(password, encr):
|
|
|
"""Получить хеш пароля
|
|
|
|
|
|
password - пароль
|
|
|
encr - алгоритм шифрования, например 'ssha'
|
|
|
"""
|
|
|
encryptObj = encrypt()
|
|
|
hashPwd = encryptObj.getHashPasswd(password, encr.lower())
|
|
|
if hashPwd:
|
|
|
return hashPwd
|
|
|
else:
|
|
|
encryptObj.printERROR(_("Error encrypt password, "
|
|
|
"method getHash()"))
|
|
|
cl_overriding.exit(1) |
