sss_obfuscate revision 675f529e1a0ada1b1a400a59465560ab88a6e24c
199767f8919635c4928607450d9e0abb932109ceToomas Soome#!/usr/bin/python
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soomeimport sys
199767f8919635c4928607450d9e0abb932109ceToomas Soomefrom optparse import OptionParser
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soomeimport pysss
199767f8919635c4928607450d9e0abb932109ceToomas Soomeimport SSSDConfig
199767f8919635c4928607450d9e0abb932109ceToomas Soomeimport getpass
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soomedef parse_options():
199767f8919635c4928607450d9e0abb932109ceToomas Soome parser = OptionParser()
199767f8919635c4928607450d9e0abb932109ceToomas Soome parser.set_description("sss_obfuscate converts a given password into \
199767f8919635c4928607450d9e0abb932109ceToomas Soome human-unreadable format and places it into \
199767f8919635c4928607450d9e0abb932109ceToomas Soome appropriate domain section of the SSSD config \
199767f8919635c4928607450d9e0abb932109ceToomas Soome file. The password can be passed in by stdin, \
199767f8919635c4928607450d9e0abb932109ceToomas Soome specified on the command-line or entered \
199767f8919635c4928607450d9e0abb932109ceToomas Soome interactively")
199767f8919635c4928607450d9e0abb932109ceToomas Soome parser.add_option("-s", "--stdin", action="store_true",
199767f8919635c4928607450d9e0abb932109ceToomas Soome dest="stdin", default=False,
199767f8919635c4928607450d9e0abb932109ceToomas Soome help="Read the password from stdin.")
199767f8919635c4928607450d9e0abb932109ceToomas Soome parser.add_option("-d", "--domain",
199767f8919635c4928607450d9e0abb932109ceToomas Soome dest="domain", default=None,
199767f8919635c4928607450d9e0abb932109ceToomas Soome help="The domain to use the password in (mandatory)",
199767f8919635c4928607450d9e0abb932109ceToomas Soome metavar="DOMNAME")
199767f8919635c4928607450d9e0abb932109ceToomas Soome parser.add_option("-f", "--file",
199767f8919635c4928607450d9e0abb932109ceToomas Soome dest="filename", default=None,
199767f8919635c4928607450d9e0abb932109ceToomas Soome help="Set input file to FILE (default: Use system default, usually /etc/sssd/sssd.conf)",
199767f8919635c4928607450d9e0abb932109ceToomas Soome metavar="FILE")
199767f8919635c4928607450d9e0abb932109ceToomas Soome (options, args) = parser.parse_args()
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome return options, args
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soomedef main():
199767f8919635c4928607450d9e0abb932109ceToomas Soome options, args = parse_options()
199767f8919635c4928607450d9e0abb932109ceToomas Soome if not options:
199767f8919635c4928607450d9e0abb932109ceToomas Soome print >> sys.stderr, "Cannot parse options"
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome if not options.domain:
199767f8919635c4928607450d9e0abb932109ceToomas Soome print >> sys.stderr, "No domain specified"
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome if not options.stdin:
199767f8919635c4928607450d9e0abb932109ceToomas Soome try:
199767f8919635c4928607450d9e0abb932109ceToomas Soome pprompt = lambda: (getpass.getpass("Enter password: "), getpass.getpass("Re-enter password: "))
199767f8919635c4928607450d9e0abb932109ceToomas Soome p1, p2 = pprompt()
199767f8919635c4928607450d9e0abb932109ceToomas Soome while p1 != p2:
199767f8919635c4928607450d9e0abb932109ceToomas Soome print('Passwords do not match. Try again')
199767f8919635c4928607450d9e0abb932109ceToomas Soome p1, p2 = pprompt()
199767f8919635c4928607450d9e0abb932109ceToomas Soome password = p1
199767f8919635c4928607450d9e0abb932109ceToomas Soome except EOFError:
199767f8919635c4928607450d9e0abb932109ceToomas Soome print >> sys.stderr, '\nUnexpected end-of-file. Password change aborted'
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome else:
199767f8919635c4928607450d9e0abb932109ceToomas Soome try:
199767f8919635c4928607450d9e0abb932109ceToomas Soome password = sys.stdin.read()
199767f8919635c4928607450d9e0abb932109ceToomas Soome except KeyboardInterrupt:
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome # Obfuscate the password
199767f8919635c4928607450d9e0abb932109ceToomas Soome obfobj = pysss.password()
199767f8919635c4928607450d9e0abb932109ceToomas Soome obfpwd = obfobj.encrypt(password, obfobj.AES_256)
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome # Save the obfuscated password into the domain
199767f8919635c4928607450d9e0abb932109ceToomas Soome try:
199767f8919635c4928607450d9e0abb932109ceToomas Soome sssdconfig = SSSDConfig.SSSDConfig()
199767f8919635c4928607450d9e0abb932109ceToomas Soome except IOError:
199767f8919635c4928607450d9e0abb932109ceToomas Soome print "Cannot read internal configuration files."
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome try:
199767f8919635c4928607450d9e0abb932109ceToomas Soome sssdconfig.import_config(options.filename)
199767f8919635c4928607450d9e0abb932109ceToomas Soome except IOError:
199767f8919635c4928607450d9e0abb932109ceToomas Soome print "Permissions error reading config file"
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome try:
199767f8919635c4928607450d9e0abb932109ceToomas Soome domain = sssdconfig.get_domain(options.domain)
199767f8919635c4928607450d9e0abb932109ceToomas Soome except SSSDConfig.NoDomainError:
199767f8919635c4928607450d9e0abb932109ceToomas Soome print "No such domain %s" % options.domain
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome try:
199767f8919635c4928607450d9e0abb932109ceToomas Soome domain.set_option('ldap_default_authtok_type', 'obfuscated_password')
199767f8919635c4928607450d9e0abb932109ceToomas Soome domain.set_option('ldap_default_authtok', obfpwd)
199767f8919635c4928607450d9e0abb932109ceToomas Soome except SSSDConfig.NoOptionError:
199767f8919635c4928607450d9e0abb932109ceToomas Soome print "The domain %s does not seem to support the required options" % \
199767f8919635c4928607450d9e0abb932109ceToomas Soome options.domain
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome sssdconfig.save_domain(domain)
199767f8919635c4928607450d9e0abb932109ceToomas Soome try:
199767f8919635c4928607450d9e0abb932109ceToomas Soome sssdconfig.write()
199767f8919635c4928607450d9e0abb932109ceToomas Soome except IOError:
199767f8919635c4928607450d9e0abb932109ceToomas Soome # File could not be written
199767f8919635c4928607450d9e0abb932109ceToomas Soome print >> sys.stderr, "Could not write to config file. Check that " \
199767f8919635c4928607450d9e0abb932109ceToomas Soome "you have the appropriate permissions to edit " \
199767f8919635c4928607450d9e0abb932109ceToomas Soome "this file."
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 1
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soome return 0
199767f8919635c4928607450d9e0abb932109ceToomas Soome
199767f8919635c4928607450d9e0abb932109ceToomas Soomeif __name__ == "__main__":
199767f8919635c4928607450d9e0abb932109ceToomas Soome ret = main()
199767f8919635c4928607450d9e0abb932109ceToomas Soome sys.exit(ret)
199767f8919635c4928607450d9e0abb932109ceToomas Soome