You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
148 lines
5.0 KiB
148 lines
5.0 KiB
# -*- coding: utf-8 -*-
|
|
|
|
# Copyright 2008-2016 Mir Calculate. http://www.calculate-linux.org
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
|
|
import sys
|
|
import os
|
|
import hashlib
|
|
import crypt
|
|
import string
|
|
from random import choice
|
|
from base64 import encodebytes as _b64enc
|
|
|
|
b64encode = lambda x: _b64enc(x).rstrip()
|
|
import calculate.contrib
|
|
from passlib.hash import nthash, lmhash, sha256_crypt, grub_pbkdf2_sha512
|
|
from .cl_print import color_print
|
|
from . import cl_overriding
|
|
|
|
from .cl_lang import setLocalTranslate
|
|
|
|
_ = lambda x: x
|
|
setLocalTranslate('cl_lib3', sys.modules[__name__])
|
|
|
|
def get_shadow_hash():
|
|
"""
|
|
Получить энкриптор для паролей unix
|
|
:return:
|
|
"""
|
|
return sha256_crypt.using(rounds=5000, salt_size=8)
|
|
|
|
def get_grub_hash():
|
|
"""
|
|
Получить энкриптор для паролей grub
|
|
:return:
|
|
"""
|
|
return grub_pbkdf2_sha512
|
|
|
|
class encrypt(color_print):
|
|
"""Класс хранения общих методов используемых для настройки сервисов
|
|
|
|
Методы шифрования, создания сертификатов и.т. д
|
|
"""
|
|
|
|
def __GenCryptSalt__(self, len=2):
|
|
"""Генерация соли для хеширования пароля (CRYPT)"""
|
|
chars = string.ascii_letters + string.digits + "./"
|
|
salt = ""
|
|
for i in range(len):
|
|
salt = salt + choice(chars)
|
|
return salt
|
|
|
|
def getHashPasswd(self, password, SecHashAlg):
|
|
"""Генерация хеша пароля,
|
|
|
|
Поддерживаемые алгоритмы шифрования пароля:
|
|
plain, md5, smd5, crypt, sha, ssha, lm, nt, shadow_ssha512,
|
|
shadow_ssha256, shadow_md5
|
|
"""
|
|
if not password:
|
|
self.printERROR(_("ERROR") + " getHashPasswd: " +
|
|
_("empty password"))
|
|
return False
|
|
|
|
if SecHashAlg == "plain":
|
|
hash_pwd = password
|
|
|
|
elif SecHashAlg == "md5":
|
|
h = hashlib.md5(password.encode("UTF-8"))
|
|
hash_pwd = "{MD5}" + b64encode(h.digest()).decode("UTF-8")
|
|
|
|
elif SecHashAlg == "smd5":
|
|
salt = os.urandom(4)
|
|
h = hashlib.md5(password.encode("UTF-8"))
|
|
h.update(salt)
|
|
hash_pwd = "{SMD5}" + b64encode(h.digest() + salt).decode("UTF-8")
|
|
|
|
elif SecHashAlg == "shadow_ssha512":
|
|
salt = self.__GenCryptSalt__(8)
|
|
hash_pwd = crypt.crypt(password, "$6$%s$" % salt)
|
|
|
|
elif SecHashAlg == "shadow_ssha256":
|
|
salt = self.__GenCryptSalt__(8)
|
|
hash_pwd = crypt.crypt(password, "$5$%s$" % salt)
|
|
|
|
elif SecHashAlg == "shadow_md5":
|
|
salt = self.__GenCryptSalt__(8)
|
|
hash_pwd = crypt.crypt(password, "$1$%s$" % salt)
|
|
|
|
elif SecHashAlg == "crypt":
|
|
salt = self.__GenCryptSalt__()
|
|
hash_pwd = "{CRYPT}" + crypt.crypt(password, salt)
|
|
|
|
elif SecHashAlg == "sha":
|
|
h = hashlib.sha1(password.encode("UTF-8"))
|
|
hash_pwd = "{SHA}" + b64encode(h.digest()).decode("UTF-8")
|
|
|
|
elif SecHashAlg == "ssha":
|
|
salt = os.urandom(4)
|
|
h = hashlib.sha1(password.encode("UTF-8"))
|
|
h.update(salt)
|
|
hash_pwd = "{SSHA}" + b64encode(h.digest() + salt).decode("UTF-8")
|
|
|
|
elif SecHashAlg == "lm":
|
|
hash_pwd = lmhash.hash(password).upper()
|
|
elif SecHashAlg == "nt":
|
|
hash_pwd = nthash.hash(password).upper()
|
|
else:
|
|
if SecHashAlg in ("lm", "nt"):
|
|
self.printERROR(
|
|
_("ERROR") + " getHashPasswd: " +
|
|
(_("Failed to support '%s' encryption algorithm")
|
|
% SecHashAlg) + " " + _("without py-smbpasswd"))
|
|
else:
|
|
self.printERROR(_("ERROR") + " getHashPasswd: " +
|
|
_("Failed to support '%s' encryption algorithm")
|
|
% SecHashAlg)
|
|
return False
|
|
return hash_pwd
|
|
|
|
|
|
def getHash(password, encr):
|
|
"""Получить хеш пароля
|
|
|
|
password - пароль
|
|
encr - алгоритм шифрования, например 'ssha'
|
|
"""
|
|
encryptObj = encrypt()
|
|
hashPwd = encryptObj.getHashPasswd(password, encr.lower())
|
|
if hashPwd:
|
|
return hashPwd
|
|
else:
|
|
encryptObj.printERROR(_("Password encryption error, "
|
|
"method getHash()"))
|
|
cl_overriding.exit(1)
|