File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__pycache__/pam.cpython-310.pyc
Back
o ;j�0 � @ s� d Z ddlZddlZddlZddlZddlZddlmZmZm Z m Z m Z m Z m Z mZmZmZmZmZ ddlmZ dZzddlZW n eyK dZY nw e�e�Zz eed��Z e j Z ee _ eege _ e j!Z"e ge"_#e e �e"_ W n e$y� ej%ddd � dZ&Y nw dZ&d Z'd Z(d Z)d Z*G dd� de �Z+G dd� de �Z,G dd� de �Z-ee e e e e,��e e e-��e�Z.G dd� de �Z/z:eed��Z0e0j1Z2e e2_ e e e e/�e e+�ge2_ e0j3Z4e e4_ e+e ge4_ e0j5Z6e e6_ e+e ge6_ e0j7Z8e e8_ e+e ge8_ W n e$�y ej%ddd � dZ9Y nw dZ9dd� Z:d-dd �Z;da<d Z=d d � Z>d d!� Z?d"d#� Z@d$d%� ZAd&d'� ZBed(k�rSe;ejCd) ejCd* ejCd+ ejCd, ��rLe�Dd� e�Dd � dS dS ).a� Authenticate against PAM Provides an authenticate function that will allow the caller to authenticate a user against the Pluggable Authentication Modules (PAM) on the system. Implemented using ctypes, so no compilation is necessary. There is one extra configuration option for pam. The `pam_service` that is authenticated against. This defaults to `login` .. code-block:: yaml auth.pam.service: login .. note:: Solaris-like (SmartOS, OmniOS, ...) systems may need ``auth.pam.service`` set to ``other``. .. note:: PAM authentication will not work for the ``root`` user. The Python interface to PAM does not support authenticating as ``root``. .. note:: This module executes itself in a subprocess in order to user the system python and pam libraries. We do this to avoid openssl version conflicts when running under a salt onedir build. .. note:: Running ``salt-master`` as a non-root user (the 3006.x packaging default is the ``salt`` user) and using PAM eauth requires extra privileges so that PAM's ``unix_chkpwd`` helper can validate other users' passwords. ``unix_chkpwd`` refuses to authenticate users other than the caller unless the caller can read ``/etc/shadow``. The two standard remediations are: 1. **Debian-derived distributions:** add the master's user to the ``shadow`` group (e.g. ``usermod -a -G shadow salt``) so the master process can read ``/etc/shadow`` indirectly via the setgid-shadow ``unix_chkpwd`` helper. 2. **RPM-based distributions:** revert the master to run as ``root`` (``user: root`` in ``/etc/salt/master``); ``/etc/shadow`` cannot be made readable to a non-root group safely there. When PAM auth fails and the master is running as a non-root user without ``/etc/shadow`` access, a CRITICAL log entry naming the cause and the two remediations is emitted (once per process). See https://github.com/saltstack/salt/issues/64275 for the full discussion. � N) �CDLL� CFUNCTYPE�POINTER� Structure�c_char�c_char_p�c_int�c_uint�c_void_p�cast�pointer�sizeof)� find_libraryTF�cz Failed to load libc using ctypes)�exc_info� � � � c @ s" e Zd ZdZdefgZdd� ZdS )� PamHandlez( Wrapper class for pam_handle_t �handlec C s t �| � d| _d S )Nr )r �__init__r ��self� r �A/opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/pam.pyr p s zPamHandle.__init__N)�__name__� __module__� __qualname__�__doc__r �_fields_r r r r r r i s r c @ �( e Zd ZdZdefdefgZdd� ZdS )� PamMessagez1 Wrapper class for pam_message structure � msg_style�msgc C � d| j � d| j� d�S )Nz <PamMessage � '�'>)r# r$ r r r r �__repr__ � zPamMessage.__repr__N)r r r r r r r r( r r r r r" u � � r" c @ r! )� PamResponsez2 Wrapper class for pam_response structure �resp� resp_retcodec C r% )Nz <PamResponse r& r' )r- r, r r r r r( � r) zPamResponse.__repr__N)r r r r r r r r( r r r r r+ � r* r+ c @ s e Zd ZdZdefdefgZdS )�PamConvz. Wrapper class for pam_conv structure �convZ appdata_ptrN)r r r r � CONV_FUNCr r r r r r r. � s r. Zpamz Failed to load pam using ctypesc C s t otS )z$ Only load on Linux systems )�HAS_LIBC�HAS_PAMr r r r � __virtual__� s r3 �utf-8c s� t �t�r ��|��t � t�r� �|�� t |t�r |�|�}t� �fdd��}t� }t|d�}t|�t|�t|��}|dkrEt||� dS t |d�}|dkrSt |d�}t|d� |dkS )�� Returns True if the given username and password authenticate for the given service. Returns False otherwise ``username``: the username to authenticate ``password``: the password in plain text c s� t | tt��}t|tt��|d< t| �D ]*}|| jj}|tkr%t � �}n |t kr.t ��}nqt|t �|j| _ d|j| _ qdS )u~ Conversation function that answers PAM prompts: * ``PAM_PROMPT_ECHO_OFF`` (hidden input) is answered with the supplied password. * ``PAM_PROMPT_ECHO_ON`` (visible input) is answered with the supplied username. Some PAM modules issue such a prompt — for example to re-prompt for the user — and previously the conv left that response slot NULL, which caused ``pam_authenticate`` to fail with no diagnostic. * ``PAM_ERROR_MSG`` and ``PAM_TEXT_INFO`` are informational and require no response; their CALLOC-zeroed slots are left alone. r )�CALLOCr r+ r r �range�contentsr# �PAM_PROMPT_ECHO_OFF�STRDUP�PAM_PROMPT_ECHO_ONr r, r- )Z n_messages�messagesZ p_responseZapp_data�addr�i�styleZ resp_copy��password�usernamer r �my_conv� s z _authenticate.<locals>.my_convr F) � isinstance�str�encoder0 r r. � PAM_STARTr �PAM_END�PAM_AUTHENTICATE� PAM_ACCT_MGMT)rB rA Zservice�encodingrC r r/ �retvalr r@ r � _authenticate� s& rM z /etc/shadowc C sT z t �� dkr W dS W n ty Y dS w t �tt j�r dS ddjt �� td�fS )u� Return ``(True, "")`` if the current process has the privileges PAM needs to validate a *different* user's password via ``unix_chkpwd``; return ``(False, <reason>)`` otherwise. On Linux PAM's ``pam_unix`` module shells out to the setgid-shadow helper ``unix_chkpwd`` for password verification. ``unix_chkpwd`` refuses to authenticate users other than the caller unless the caller can read ``/etc/shadow`` — either because the caller's effective uid is 0, or because the caller is in the ``shadow`` group (Debian-style). See linux-pam upstream discussion at https://github.com/linux-pam/linux-pam/issues/112 for the full rationale. This helper is used to produce an actionable diagnostic when ``authenticate()`` fails on a master running as a non-root user without ``shadow``-group access — the failure mode behind issue #64275, which previously logged only a bare "Pam auth failed" with empty stdout/stderr. r )T� Fz�process running as uid {uid} cannot read {shadow}, so PAM's unix_chkpwd helper will refuse to authenticate users other than the caller)�uidZshadow)�os�geteuid�AttributeError�access� _SHADOW_PATH�R_OK�formatr r r r �_can_validate_other_users s � � ��rW c C s2 t rdS t� \}}|r dS da t�d| |t� dS )a� Emit, at most once per process, a CRITICAL log entry that explains why PAM auth is failing on a non-root master and how to fix it. Issue #64275: when the master runs as the ``salt`` user (the 3006.x packaging default) PAM auth fails silently because the helper subprocess inherits that uid and ``unix_chkpwd`` can't read ``/etc/shadow``. Three years of users hit this without a diagnostic; this function makes the failure self-explanatory. NTaZ PAM authentication for %r failed and %s. Either run the salt-master as the 'root' user, or add the master's user to the 'shadow' group so it can read %s (the latter works on Debian-derived distributions; on RPM-based distributions the master must run as root for PAM eauth to work). See https://github.com/saltstack/salt/issues/64275 for context.)�_SHADOW_DIAGNOSTIC_LOGGEDrW �log�criticalrT )rB �ok�reasonr r r �_log_shadow_diagnostic_once. s �r] c C s� t j�� }| |d< ||d< t�dd�|d< t|d< t�t�dd���� }t�t ��� }|� � s7t � d |� d S t jt|�t|�g|d d d �}|jd krMd S t � d| |j|j� t| � d S )r5 �SALT_PAM_USERNAME�SALT_PAM_PASSWORDzauth.pam.serviceZlogin�SALT_PAM_SERVICE�SALT_PAM_ENCODINGzauth.pam.pythonz/usr/bin/python3z7Error 'auth.pam.python' config value does not exist: %sFT)�env�capture_output�checkr z Pam auth failed for %s: %s %s)rP �environ�copyZ__opts__�getZ__salt_system_encoding__�pathlib�Path�resolve�__file__�existsrY �error� subprocess�runrE � returncode�stdout�stderrr] )rB rA rb ZpyexeZpyfile�retr r r � authenticateM s* � rt c K s t | |�S )z Authenticate via pam )rt )rB rA �kwargsr r r �authq s rv c O s t jj�| �S )zY Retrieve groups for a given user for this auth provider Uses system groups )�salt�utils�userZget_group_list)rB �argsru r r r �groupsx s r{ �__main__r^ r_ r` ra )r4 )Er �loggingrP rh rn �sys�ctypesr r r r r r r r r r r r Z ctypes.utilr ZHAS_USERZsalt.utils.userrw � ImportError� getLoggerr rY ZLIBCZcallocr6 �restype�argtypesZstrdupr: Z argstypes� ExceptionZtracer1 r9 r; Z PAM_ERROR_MSGZ PAM_TEXT_INFOr r" r+ r0 r. ZLIBPAMZ pam_startrG Zpam_authenticaterI Z pam_acct_mgmtrJ Zpam_endrH r2 r3 rM rX rT rW r] rt rv r{ re �exitr r r r �<module> s� /8 � � � � B( $ � �
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings