File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/ssh.cpython-310.pyc
Back
o ;j � � @ s d Z ddlZddlZddlZddlZddlZddlZddlZddlZ ddl Z ddl Z ddl Z ddl Z ddlZ ddlmZmZ e�e�ZdZdd� Zdd� Zd d � Zd d � Zd d� Z dEdd�Zdd� Z dd� Z dFdd�Z dGdd �Z dHd d �Z dId d!�Z! dJd"d#�Z" dId$d%�Z#dKd&d'�Z$ dId(d)�Z% dLd*d+�Z&d,d-� Z'dMd.d/�Z(e j)j*j+�,d0� dNd1d2��Z-e j)j*j+�,d3� 4 dOd5d6��Z. dPd7d8�Z/dQd9d:�Z0 4 dRd;d<�Z1dNd=d>�Z2e j)j*j+�,d0�dFd?d@��Z3efdAdB�Z4dCdD� Z5dS )Sz� Manage client ssh components .. note:: This module requires the use of MD5 hashing. Certain security audits may not permit the use of MD5. For those cases, this module should be disabled or removed. � N)�CommandExecutionError�SaltInvocationError� c C s t jj�d�s dS dS )NZssh)Fz#The module requires the ssh binary.T)�salt�utils�path�which� r r �D/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/ssh.py� __virtual__ s r c C s� g d�}g d�}g d�}ddg}g d�}| |v rdS | |v r dS | |v r,| d v r*d S | S | |v r2dS | |v r8| S t d | � d ���) z� Return the properly formatted ssh value for the authorized encryption key type. ecdsa defaults to 256 bits, must give full ecdsa enc schema string if using higher enc. If the type is not found, raise CommandExecutionError. )�r�rsa�ssh-rsa)�dZdsa�dss�ssh-dss)�e�ecdsazecdsa-sha2-nistp521zecdsa-sha2-nistp384�ecdsa-sha2-nistp256�ed25519z ssh-ed25519) z rsa-sha2-512z rsa-sha2-256z!rsa-sha2-512-cert-v01@openssh.comz!rsa-sha2-256-cert-v01@openssh.comz ssh-rsa-cert-v01@openssh.comz(ecdsa-sha2-nistp256-cert-v01@openssh.comz(ecdsa-sha2-nistp384-cert-v01@openssh.comz(ecdsa-sha2-nistp521-cert-v01@openssh.comz"sk-ecdsa-sha2-nistp256@openssh.comz+sk-ecdsa-sha2-nistp256-cert-v01@openssh.comz ssh-ed25519-cert-v01@openssh.comzsk-ssh-ed25519@openssh.comz#sk-ssh-ed25519-cert-v01@openssh.comr r )r r r z Incorrect encryption key type 'z'.)r )�encr r r r Z also_allowedr r r � _refine_enc& s$ r c C s: d}|r|d� d�|��7 }||� d| � d|� d�7 }|S )z% Properly format user input. � z{} �,� � )�format�join)�keyr �comment�options�liner r r �_format_auth_lineY s r" c C s� d}d}| D ]6}|r1d}|dkr|d7 }n|dkr ||7 }n|dkr'||7 }n d� |�}t|��q|dkr8d}q||7 }q|rEd}t|��|S ) zQ Expand the AuthorizedKeysFile expression. Defined in man sshd_config(5) r F�%�u�hz6AuthorizedKeysFile path: unknown token character "%{}"TzAAuthorizedKeysFile path: Last character can't be escape character)r r )r �user�homeZconverted_pathZ had_escape�char�errorr r r � _expand_authorized_keys_pathd s. � r* c C sR t d | �}|std| � d���|d }t|| |�}tj�|�s'tj�||�}|S )z3 Get absolute path to a user's ssh_config. � user.infozUser 'z' does not existr' )�__salt__r r* �osr �isabsr )r& �config�uinfor' r r r �_get_config_file� s r1 r r �.ssh/authorized_keysc C sj t ||||pg �}g }t| |�}z�tjj�|d��~} | D ]B} tjj�| �� �} | dkr,q | d7 } | � d�r;|� | � q t � d| �} | rYt | d �dkrY| d d |krY|� |� q |� | � q | �� tjj�|d��} | �tjj�|�� W d � n1 s�w Y W d � W d S W d � W d S 1 s�w Y W d S ty� } ztd | � ���d } ~ ww ) z! Replace an existing key r r r �#zN((.*)\s)?((?:sk-)?(?:ssh|ecdsa)-[a-z0-9@.-]+)\s([a-zA-Z0-9+/]+={0,2})(\s(.*))?r � �wbNz(Problem reading or writing to key file: )r" r1 r r �files�fopen� stringutils� to_unicode�strip� startswith�append�re�findall�len�close� writelines�data�encode�OSErrorr ) r& r r r r r/ � auth_line�lines�full�_fhr! �comps�excr r r �_replace_auth_key� s> �$ ��&���rK c C s4 i }t �d�}z�tjj�| d��q}|D ]d}tjj�|�� �}|dkr#q|d7 }|� d�r-qt � ||�}|s6q|� d�}|� d�� � }t |�dk rIq|rQ|� d�} ng } |d } |d } d �|dd � �} t| |�} | d u rnq| | | | d �|| < qW d � W |S 1 s�w Y W |S ty� td | � ���w )zD Return a dict containing validated keys in the passed file �.^(.*?)\s?((?:sk-)?(?:ssh\-|ecds)[\w@.-]+\s.+)$r r r r3 � � r r r N)r r r � fingerprintz Problem reading ssh key file )r= �compiler r r6 r7 r8 r9 r: r; �search�group�splitr? r � _fingerprintrD r )�key_file�fingerprint_hash_type�ret�linererH r! rQ �optsrI r r r r rO r r r �_validate_keys� sP �� �/�/ ��rZ c s� |r|� � }nd}ztt|�}W n ty td|� d���w z tj| dd�}W n tjy4 Y dS w ||�� � � � fdd�t d t � �d �D �}d � |�S ) a� Return a public key fingerprint based on its base64-encoded representation The fingerprint string is formatted according to RFC 4716 (ch.4), that is, in the form "xx:xx:...:xx" If the key is invalid (incorrect base64 string), return None public_key The public key to return the fingerprint for fingerprint_hash_type The public key fingerprint hash type that the public key fingerprint was originally hashed with. This defaults to ``sha256`` if not specified. .. versionadded:: 2016.11.4 .. versionchanged:: 2017.7.0 default changed from ``md5`` to ``sha256`` �sha256zThe fingerprint_hash_type z is not supported.T)�validateNc s g | ] }� ||d � �qS )rN r )�.0�i�rW r r � <listcomp> s z _fingerprint.<locals>.<listcomp>r rN �:) �lower�getattr�hashlib�AttributeErrorr �base64� b64decode�binascii�Error� hexdigest�ranger? r )Z public_keyrV Z hash_typeZ hash_funcZraw_key�chunksr r_ r rT � s$ ��� rT c C sp |r| pd} n| p d} t j�| �r| }|S |r3td |�}|s(dd|� d�d�S t j�|d | �}|S dd d�S ) N�.ssh/known_hosts�/etc/ssh/ssh_known_hostsr+ r) zUser � does not exist��statusr) r' z'Cannot determine absolute path to file.)r- r r. r, r )r/ r& rG r0 r r r �_get_known_hosts_file$ s" � ���rr Tc C sZ | st d dkr d} ntd��i }t�d�}t�| �D ]�}|�|�}|r�|�d�s4|du r4t� d|� q|�d �rD|du rDt� d |� q|�d �}|�d�rU||�d�7 }zGt j j � tj�| |�d ��0}t j j�|�� �||< || d kr�|| t j j�|�� �7 < || �� ||< W d � n1 s�w Y W q ty� d||< Y qw q|S )a Return the minion's host keys CLI Example: .. code-block:: bash salt '*' ssh.host_keys salt '*' ssh.host_keys keydir=/etc/ssh salt '*' ssh.host_keys keydir=/etc/ssh private=False salt '*' ssh.host_keys keydir=/etc/ssh certs=False Zkernel�Linuxz/etc/sshz&ssh.host_keys: Please specify a keydirz8ssh_host_(?P<type>.+)_key(?P<pub>(?P<cert>-cert)?\.pub)?ZpubFz7Skipping private key file %s as private is set to False�certz-Skipping key file %s as certs is set to False�typer z SSH PRIVATE KEY FILE FORMAT 1.1 Nr )� __grains__r r= rP r- �listdir�matchrR �log�infor r r6 r7 r r r8 r9 �readline�readr: rD ) ZkeydirZprivate�certs�keysZfnre�fn_�mZknamerH r r r � host_keys> s> �� ��r� c C s� | st d � } d}t| t�s| g} d}i }| D ]$}d}zt||�}W n ty+ Y nw |r;tj�|�r;t||�||< q|rL| d |v rJ|| d S i S |S )z� Return the authorized keys for users CLI Example: .. code-block:: bash salt '*' ssh.auth_keys salt '*' ssh.auth_keys root salt '*' ssh.auth_keys user=root salt '*' ssh.auth_keys user="[user1, user2]" �user.list_usersFTNr ) r, � isinstance�listr1 r r- r �isfilerZ )r& r/ rV Zold_output_when_one_userr~ r$ rG r r r � auth_keyss s, �� r� �basec C s� t d ||�}|s i S t||�}|s#d|� d�}t�|� |td< i S i }|D ]} t| | || d || d || d ||d�|| < q'|S ) z� Check a keyfile from a source destination against the local keys and return the keys to change CLI Example: .. code-block:: bash salt '*' ssh.check_key_file root salt://ssh/keyfile � cp.cache_file�No keys detected in � . Is file properly formatted?�ssh_auth.errorr r r �r/ rV )r, rZ ry r) � __context__� check_key) r& �sourcer/ �saltenvrV �keyfile�s_keys�errrW r r r r �check_key_file� s* � r� c C sr |du rg }t |�}t| ||d�}t||||�} ||v r7t||| d || d || d �} | | kr5dS dS dS ) z� Check to see if a key needs updating, returns "update", "add" or "exists" CLI Example: .. code-block:: bash salt '*' ssh.check_key <user> <key> <enc> <comment> <options> Nr� r r r �update�add�exists)r r� r" ) r& r r r r r/ � cache_keysrV �currentZnlineZcliner r r r� � s � ��r� c C s� t d ||�}tj�|�std��t||�}|s)d|� d�}t�|� |td< dS d}|D ] } |t | | ||d�7 }q-d |v r@d S d |v rFd S d S ) z� Remove an authorized key from the specified user's authorized key file, using a file as source CLI Example: .. code-block:: bash salt '*' ssh.rm_auth_key_from_file <user> salt://ssh_keys/<user>.id_rsa.pub r� �-Failed to pull key file from salt file serverr� r� r� �failr r� �Key not removed� Key removed�Key not present) r, r- r r� r rZ ry r) r� � rm_auth_key) r& r� r/ r� rV �lfiler� r� �rvalr r r r �rm_auth_key_from_file� s& �r� c C s� t | ||d�}t�d�}||v r�t| |�}tj�|�s!d|� d�S g }z�tjj � |d��T}|D ]I} tjj � | � � �} | dkr?q/| d7 } | �d�rN|�| � q/t�|| �} | sWq/| �d ��� } t| �d k rj|�| � q/| d } | |krsq/|�| � q/W d � n1 s�w Y tjj � |d ��}|�tjj�|�� W d � W dS 1 s�w Y W dS ty� } z t�d | � W Y d } ~ dS d } ~ ww dS )z� Remove an authorized key from the specified user's authorized key file CLI Example: .. code-block:: bash salt '*' ssh.rm_auth_key <user> <key> r� rL zAuthorized keys file z not presentr r r r3 rN rM Nr5 z!Could not read/write key file: %sr� r� r� )r� r= rP r1 r- r r� r r r6 r7 r8 r9 r: r; r< rQ rR rS r? rA rB rC rD ry �warning)r& r r/ rV r� rX rG rF rH r! rQ rI ZpkeyrJ r r r r� % sX � � �% ��� ��r� c K s� t d ||�}tj�|�std��t||�}|s)d|� d�}t�|� |td< dS d} |� dd �} |D ]"} | t | | || d || d | pJ|| d |t |� � �|d �7 } q3d| v r\dS d | v rbd S d| v rhdS dS )z� Add a key to the authorized_keys file, using a file as the source. CLI Example: .. code-block:: bash salt '*' ssh.set_auth_key_from_file <user> salt://ssh_keys/<user>.id_rsa.pub r� r� r� r� r� r� r r Nr r )r r r r/ r� rV �replace�new� no change) r, r- r r� r rZ ry r) r� �get� set_auth_keyr� r~ ) r& r� r/ r� rV �kwargsr� r� r� r� r r r r r �set_auth_key_from_filen s: �r� c C s� |du rg }t |�� �dkrdS t|�}td | �}|s dS t||�du} | s)dS t| |||||||d�} | dkrFt| ||||pAg |� d S | d krLd S t||||�} t| |�} |� d d �} | � | �rkt j � | �skdS t j � t j �| ��s�t j �| �}t �|� tjj�� s�t �� dkr�t �||d |d � t �|d� tjj �d�}|r�||g}t�|� t j �| �s�d}nd}zFtjj� | d��4}|du r�|� dd� |� � dkr�|� dd� |� d�dkr�|� d� |� tjj!�"| �� W d � n1 s�w Y W n t#�y } z d}t$|�%|���d}~ww |�rLtjj�� �s9t �� dk�r3t �| |d |d � t �| d� tjj �d�}|�rL|| g}t�|� dS ) ah Add a key to the authorized_keys file. The "key" parameter must only be the string of text that is the encoded key. If the key begins with "ssh-rsa" or ends with user@host, remove those from the key before passing it to this function. CLI Example: .. code-block:: bash salt '*' ssh.set_auth_key <user> '<key>' enc='dsa' NrM �invalidr+ r� zInvalid public key)r/ r� rV r� r� r� r� r' r r �uid�gid� Z restoreconTFzab+rN ���� z Could not write to key file: {0}� r� )&r? rS r r, rT r� rK r" r1 r� r; r- r �isdir�dirname�makedirsr r �platform� is_windows�geteuid�chown�chmodr � subprocess�callr� r6 r7 �seek�tellr| �writer8 �to_bytesrD r r )r& r r r r r/ r� rV r0 Z key_is_validrq rE ZfconfigZudirZdpathZrcon�cmdZnew_filerH rJ �msgr r r r� � s� � �� �� r� c c sh � t | �D ],\}}|d dkr1t|�� �� d �}| |d �� �� d }|dur.||kr.q|V qdS )z� Helper function which parses ssh-keygen -F function output and yield line number of known_hosts entries with encryption key type matching enc, one by one. rN r r� rM ���N)� enumerate�intr: rS )rF r r^ r! �line_noZline_encr r r � _get_matched_host_line_numbers s � ��r� c c s~ � | D ]9}|� � }|dkrq|d7 }|�d�rqz |�� \}}}W n ty* Y qw t||d�}|s4q||||d�V qdS )z� Helper function which parses ssh-keygen -F and ssh-keyscan function output and yield dict with keys information, one by one. r r r3 �rV )�hostnamer r rO N)r: r; rS � ValueErrorrT )rF rV r! r� r r rO r r r �_parse_openssh_output# s$ � � �r� � ssh-keygenc C sd t || d�}t|t�r |S t||�}dd|d|g}td |ddd��� }tt||d ��} | r0| S d S ) a .. versionadded:: 2018.3.0 Return information about known host entries from the configfile, if any. If there are no entries for a matching hostname, return None. CLI Example: .. code-block:: bash salt '*' ssh.get_known_host_entries <user> <hostname> �r/ r& r� �-F�-f�cmd.runTF�Zignore_retcode� python_shellr� N)rr r� �dict�"_hostname_and_port_to_ssh_hostnamer, � splitlinesr� r� ) r& r� r/ �portrV rG � ssh_hostnamer� rF �known_host_entriesr r r �get_known_host_entries; s �� � r� � ssh-keyscan� c C s� d}dg}|r|� d|g� |r|� d|g� |s't�d�|v r'|� ddg� |r.|�d� |� dt|�g� |�| � d }d } |sZ| d krZ| d } td |dd��� }|sZ| d ksFtt||d��} | rf| S d S )a9 .. versionadded:: 2018.3.0 Retrieve information about host public keys from remote server hostname The name of the remote host (e.g. "github.com") enc Defines what type of key is being used, can be ed25519, ecdsa, ssh-rsa, ssh-dss or any other type as of openssh server version 8.7. port Optional parameter, denoting the port of the remote host on which an SSH daemon is running. By default the port 22 is used. hash_known_hosts : True Hash all hostnames and addresses in the known hosts file. timeout : int Set the timeout for connection attempts. If ``timeout`` seconds have elapsed since a connection was initiated to a host or since the last time anything was read from that host, then the connection is closed and the host in question considered unavailable. Default is 5 seconds. fingerprint_hash_type The fingerprint hash type that the public key fingerprints were originally hashed with. This defaults to ``sha256`` if not specified. .. versionadded:: 2016.11.4 .. versionchanged:: 2017.7.0 default changed from ``md5`` to ``sha256`` CLI Example: .. code-block:: bash salt '*' ssh.recv_known_host_entries <hostname> enc=<enc> port=<port> )zCentOS-5r� z-pz-tZosfingerr �-Hz-TNr� r rM r� F�r� r� ) �extendrv r� r< �strr, r� r� r� ) r� r r� �hash_known_hosts�timeoutrV Z need_dash_tr� rF �attemptsr� r r r �recv_known_host_entries[ s, 3 � � r� c C s� |sddd�S | s|p d}n|pd}t | ||||d�}|r#d|v r#|S |r,dd� |D �ng }|r7d d� |D �ng } |s=d S |rG||v rEd S d S |rQ|| v rOd S d S d S ) a8 Check the record in known_hosts file, either by its value or by fingerprint (it's enough to set up either key or fingerprint, you don't need to set up both). If provided key or fingerprint doesn't match with stored value, return "update", if no value is found for a given host, return "add", otherwise return "exists". If neither key, nor fingerprint is defined, then additional validation is not performed. CLI Example: .. code-block:: bash salt '*' ssh.check_known_host <user> <hostname> key='AAAA...FAaQ==' r) �hostname argument requiredrp rn rm �r/ r� rV c S � g | ]}|d �qS �r r �r] r% r r r r` � � z$check_known_host.<locals>.<listcomp>c S r� �rO r r� r r r r` � r� r� r� r� )r� ) r& r� r rO r/ r� rV r� � known_keys�known_fingerprintsr r r �check_known_host� s0 � �r� c C s� |sddd�S t || d�}t|t�r|S tj�|�s#dd|� d�d�S t||�}dd|d |g}td |d d �}tj j � � sVt� � d krV| rVtd | �}t� ||d |d � d|d�S )z� Remove all keys belonging to hostname from a known_hosts file. CLI Example: .. code-block:: bash salt '*' ssh.rm_known_host <user> <hostname> r) r� rp r� �Known hosts file ro r� z-Rr� r� Fr� r r+ r� r� Zremoved�rq r )rr r� r� r- r r� r� r, r r r� r� r� r� ) r& r� r/ r� rG r� r� � cmd_resultr0 r r r � rm_known_host� s" � r� c # s� |sddd�S |dur|t kr|rddd�S d} d} t| |||| d�} | r+d| v r+| S | r6� fdd �| D �ng } | rAd d � | D �ng }| sHd } n |rQ||vrQd } n|rZ|| vrZd } n |du rd|du rdd } | sm| smd | d �S |s�t|� |||| d�}|r�dd � |D �ng }|r�dd � |D �ng }|s�ddd�S |r�||vr�ddd�S | r�t|�t| �kr�d | d �S t|| d�}t|t�r�|S tj� |��rIt� |�j }t ||�}dd|d|g}t d |d dd��� }tt|� ��}|�rHzHtjj�|d��5}tjj�t|��}t|d d�D ]}||d = �q|�d � |�� |�tjjj|d d �� W d � n 1 �s-w Y W n t�yG } zt d � |���d}~ww nd}|�rU|� |d �g}g }|D ].} |�sl|t dfv �sld | d! v �rud"j d6i | ��} n || d#< d$j d6i | ��} |� | � �qYtj� |�} | �r�t d% | �} z t �!d&| � t�"| � W n4 t�y� } z'| j#d d'k�r�t �$d(| | j#d � n| j#d d)k�r�t �!d*| � W Y d} ~ nd} ~ ww | �r�t�%| | d+ | d, � t�&| d-� z%tjj�|d.��}|�tjj�'|�� W d � n 1 �s w Y W n t�y' } zt d/|� d0���d}~ww tjj(�)� �sTt�*� d k�rD| �rDt�%|| d+ | d, � |�rNt�&||� nt�&|d1� |�rb|�rbt d2 | |d3�}!d4| |d5�}"|"S )7a� Download SSH public key from remote host "hostname", optionally validate its fingerprint against "fingerprint" variable and save the record in the known_hosts file. If such a record does already exists in there, do nothing. user The user who owns the ssh authorized keys file to modify hostname The name of the remote host (e.g. "github.com") fingerprint The fingerprint of the key which must be present in the known_hosts file (optional if key specified) key The public key which must be presented in the known_hosts file (optional if fingerprint specified) port optional parameter, denoting the port of the remote host, which will be used in case, if the public key will be requested from it. By default the port 22 is used. enc Defines what type of key is being used, can be ed25519, ecdsa, ssh-rsa, ssh-dss or any other type as of openssh server version 8.7. config The location of the authorized keys file relative to the user's home directory, defaults to ".ssh/known_hosts". If no user is specified, defaults to "/etc/ssh/ssh_known_hosts". If present, must be an absolute path when a user is not specified. hash_known_hosts : True Hash all hostnames and addresses in the known hosts file. timeout : int Set the timeout for connection attempts. If ``timeout`` seconds have elapsed since a connection was initiated to a host or since the last time anything was read from that host, then the connection is closed and the host in question considered unavailable. Default is 5 seconds. .. versionadded:: 2016.3.0 fingerprint_hash_type The public key fingerprint hash type that the public key fingerprint was originally hashed with. This defaults to ``sha256`` if not specified. .. versionadded:: 2016.11.4 .. versionchanged:: 2017.7.0 default changed from ``md5`` to ``sha256`` CLI Example: .. code-block:: bash salt '*' ssh.set_known_host <user> fingerprint='xx:xx:..:xx' enc='ssh-rsa' config='.ssh/known_hosts' r) r� rp NzKargument port can not be used in conjunction with argument hash_known_hostsFr� c s( g | ]}� d u s|d � kr|d �qS )Nr r r r� �r r r r` f s ( z"set_known_host.<locals>.<listcomp>c S r� r� r r� r r r r` k r� Tr� )rq r~ )r r� r� r� rV c S r� r� r r� r r r r` � r� c S r� r� r r� r r r r` � r� z"Unable to receive remote host keysz\Remote host public keys found but none of their fingerprints match the one you have providedr� r� r� r� r� r� zr+)�reverserM r )Zto_strz:Couldn't remove old entry(ies) from known hosts file: '{}')r� r r ra r� z{hostname} {enc} {key} r� z [{hostname}]:{port} {enc} {key} r+ z#Ensuring ssh config dir "%s" existszPermission deniedz!Unable to create directory %s: %sz File existsz'%s already exists, no need to create itr� r� r� �abz&Couldn't append to known hosts file: '�'r� zssh.hash_known_hosts)r& r/ �updated)rq �oldr� r )+�DEFAULT_SSH_PORTr� r� �setrr r� r� r- r r� �stat�st_moder� r, r� r� r� r r r6 r7 rB �decode�sortedr� �truncaterA rD r r r< r� ry �debugr� �argsr) r� r� rC r� r� r� )#r& r� rO r r� r r/ r� r� rV Zupdate_requiredZcheck_requiredZstored_host_entriesZ stored_keysZstored_fingerprintsZremote_host_entriesr� r� rG �origmoder� r� rF Z remove_linesZofileZknown_hosts_linesr� � exception�entryr! Zssh_dirr0 rJ r� r� r r� r �set_known_host s J �� ��� � ��� � �� � �� ������ �� �� ��� r c C sn | st d � } t| t�s| g} i }| D ]�}i ||< t d |�}d|vr$qg }|r.|�|� n |dur8|g d�7 }|r@|�|� n |durJ|g d�7 }|D ]V}|�d�r\tj�|�}|} n |}d�|d |�} tj� | �r�z,t j j � | d ��} d �t j j�| �� ���� || |< W d � n1 s�w Y W qL ty� Y qLw qLqi } |D ] }|| r�|| | |< q�| S ) a� Return the user's ssh keys on the minion .. versionadded:: 2014.7.0 CLI Example: .. code-block:: bash salt '*' ssh.user_keys salt '*' ssh.user_keys user=user1 salt '*' ssh.user_keys user=user1 pubfile=/home/user1/.ssh/id_rsa.pub prvfile=/home/user1/.ssh/id_rsa salt '*' ssh.user_keys user=user1 prvfile=False salt '*' ssh.user_keys user="['user1','user2'] pubfile=id_rsa.pub prvfile=id_rsa As you can see you can tell Salt not to read from the user's private (or public) key file by setting the file path to ``False``. This can be useful to prevent Salt from publishing private data via Salt Mine or others. r� r+ r' F)z id_rsa.pubz id_dsa.pubz id_ecdsa.pubzid_ed25519.pub)Zid_rsaZid_dsaZid_ecdsaZ id_ed25519�/z {}/.ssh/{}r r N)r, r� r� r< r; r- r �basenamer r� r r r6 r7 r rB r� � readlinesr: rD ) r& ZpubfileZprvfiler~ r$ �userinfoZuserKeysr Zkeynamer rH Z_keysr r r � user_keys s\ � � �� ��� �r c C s� t || d�}t|t�r |S tj�|�s dd|� d�d�S t�|�j}ddd|g}td |d d �}t� ||� t j j � � sUt�� d krU| rUtd | �}t�||d |d � d|d�S )aI Hash all the hostnames in the known hosts file. .. versionadded:: 2014.7.0 user hash known hosts of this user config path to known hosts file: can be absolute or relative to user's home directory CLI Example: .. code-block:: bash salt '*' ssh.hash_known_hosts r� r) r� ro rp r� r� r� r� Fr� r r+ r� r� r� r� )rr r� r� r- r r� r� r� r, r� r r r� r� r� r� )r& r/ rG r r� r� r0 r r r r� N s � r� c C s |r|t kr| S d| � d|� �S )N�[z]:)r� )r� r� r r r r� z s r� c C s t d | �S )ai .. versionadded:: 2015.8.7 Function to determine whether or not a private key is encrypted with a passphrase. Checks key for a ``Proc-Type`` header with ``ENCRYPTED`` in the value. If found, returns ``True``, otherwise returns ``False``. CLI Example: .. code-block:: bash salt '*' ssh.key_is_encrypted /root/id_rsa zssh.key_is_encrypted)Z __utils__r� r r r �key_is_encrypted� s r )r r Nr2 )NN)NTT)Nr2 N)r2 r� N)r2 NN)r2 N)r r Nr2 NN)N)NNN)NNTr� N)NNNNNNN)NNNN) NNNNNNNTr� N)6�__doc__rf rh rd �loggingr- r= r� Zsalt.utils.datar Zsalt.utils.decorators.pathZsalt.utils.filesZsalt.utils.pathZsalt.utils.platformZsalt.utils.stringutilsZsalt.exceptionsr r � getLogger�__name__ry r� r r r" r* r1 rK rZ rT rr r� r� r� r� r� r� r� r� r� r� r Z decoratorsr r r� r� r� r� r r r� r� r r r r r �<module> s� 3 �,: - 5, �/ �6 � -L �; �n � �K � :$ � ~N +
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings