Changeset 1935 for trunk

Timestamp:

01/17/17 17:38:36 (7 years ago)

Author:

nanardon

Message:

Add a way to inject UNIX password into base supporting it

Location:

trunk/LATMOS-Accounts

Files:

• bin/la-passwd (modified) (3 diffs)
• lib/LATMOS/Accounts/Bases/Ldap/User.pm (modified) (2 diffs)
• lib/LATMOS/Accounts/Bases/Objects.pm (modified) (1 diff)
• lib/LATMOS/Accounts/Bases/Sql/User.pm (modified) (1 diff)
• lib/LATMOS/Accounts/Bases/Unix/User.pm (modified) (1 diff)

trunk/LATMOS-Accounts/bin/la-passwd

@@ -36 +36 @@
 Don't change the password but check its validity using CrackLib.
 
+=item -f|--force
+
+Change the even it is weak (has no effect with --crypt)
+
+=item --crypt
+
+The given password is crypt using standard unix method and will be injected
+as is inside the base. Works only for base supporting this, and some form of
+password may not be updated.
+
+=item --input FILENAME
+
+Read login/password from a file in form
+
+    username:password
+
+or
+    username:password:...
+
+Everything after the second colon is ignored
+
+If C<FILENAME> is C<->, standard input is used
+
 =back
 
@@ -46 +69 @@
     's|sync=s'   => \my $sync,
     'f|force'    => \my $force,
+    'crypt'      => \my $crypt,
+    'i|input=s'  => \my $input,
     'help'       => sub { pod2usage(0) },
 ) or pod2usage();
-
-if (!$ARGV[0]) {warn "You must specify 'userid', aborting\n"; pod2usage(); }
-
-my $otype = 'user';
 
 my $LA = LATMOS::Accounts->new($config, noacl => 1);
@@ -59 +80 @@
 $labase->wexported(1);
 
-my $obj = $labase->get_object($otype, $ARGV[0]) or do {
-    die "Object $otype $ARGV[0] not found\n";
+sub set_passwd {
+    my ($obj, $password) = @_;
+    my $res = $obj->check_password($password);
+
+    if ($res !~ /^ok$/) {
+        print "Password quality: " . $res . "\n";
+        print "Cannot set bad password, use --force to bypass security\n" unless($force);
+        return 0;
+    }
+
+    return 1  if($test);
+
+    if ($obj->set_password($password)) {
+        print "Password succefully changed\n";
+        $labase->commit;
+        return 1;
+    } else {
+        warn "Error when trying to change password\n";
+        return 0;
+    }
+}
+
+if (!$ARGV[0] && !$input) {warn "You must specify 'userid', aborting\n"; pod2usage(); }
+
+my ($username, $password) = @ARGV;
+
+my $otype = 'user';
+
+
+if ($input) {
+    my $handle;
+    if ($input eq '-') {
+        $input = \*STDIN;
+    } else {
+        open($handle, '<', $input) or die "Cannot open $input: $!\n";
+    }
+
+    while (<$handle>) {
+        my ($username, $password) = split(/:/);
+        $username or next;
+        $password or next;
+
+        my $obj = $labase->get_object($otype, $username) or do {
+            warn "Object $otype $ARGV[0] not found\n";
+            next;
+        };
+
+        print "Updating user $username\n";
+        if ($crypt) {
+            if ($obj->InjectCryptPasswd($password)) {
+                $labase->commit;
+            }
+        } else {
+            set_passwd($obj, $password);
+        }
+    }
+
+} else {
+    my $obj = $labase->get_object($otype, $username) or do {
+        die "Object $otype $ARGV[0] not found\n";
+    };
+
+    unless($password) {
+        ReadMode('noecho');
+        print "Enter password: ";
+        $password = ReadLine(0);
+        ReadMode 0;
+        print "\n";
+        chomp($password);
+    }
+
+    if ($crypt) {
+        if ($obj->InjectCryptPasswd($password)) {
+            $labase->commit;
+            exit(0);
+        }
+    } else {
+        exit (!set_passwd($obj, $password));
+    } 
 };
 
-ReadMode('noecho');
-print "Enter password: ";
-my $password = ReadLine(0);
-ReadMode 0;
-print "\n";
-chomp($password);
-
-my $res = $obj->check_password($password);
-
-if ($res !~ /^ok$/) {
-    print "Password quality: " . $res . "\n";
-    die "Cannot set bad password, use --force to bypass security\n" unless($force);
-}
-
-exit(0)  if($test);
-
-if ($obj->set_password($password)) {
-    print "Password succefully changed\n";
-    $labase->commit;
-    exit 0;
-} else {
-    warn "Error when trying to change password\n";
-    exit 1;
-}

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Ldap/User.pm

@@ -101 +101 @@
         },
         homeDirectory => { },
-        userPassword => { },
         loginShell => { },
         gecos => { },
@@ -298 +297 @@
 }
 
+=head2 _InjectCryptPasswd($cryptpasswd)
+
+Inject a password encrypted using standard UNIX method.
+
+Works only for unix authentification method inside LDAP
+
+=cut
+
+sub _InjectCryptPasswd {
+    my ($self, $cryptpasswd) = @_;
+
+    my $res = $self->set_fields(
+        userPassword => '{CRYPT}' . $cryptpasswd,
+    );
+
+    if ($res) {
+        $self->base->log(LA_NOTICE, 'Crypted password injected for %s', $self->id);
+        return 1;
+    } else {
+        $self->base->log(LA_ERR, 'Cannot inject crypted password for %s', $self->id);
+        return 0;
+    }
+}
+
 1;
 

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Objects.pm

@@ -551 +551 @@
 
     return fascist_check($password, $dictionary);
+}
+
+=head2 InjectCryptPasswd($cryptpasswd)
+
+Inject a password encrypted using standard UNIX method.
+
+=cut
+
+sub InjectCryptPasswd {
+    my ($self, $cryptpasswd) = @_;
+
+    if ($self->can('_InjectCryptPasswd')) {
+        return $self->_InjectCryptPasswd($cryptpasswd);
+    } else {
+        $self->base->log('Injecting unix crypt password is not supported');
+        return;
+    }
 }
 

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Sql/User.pm

@@ -1869 +1869 @@
 }
 
+=head2 _InjectCryptPasswd($cryptpasswd)
+
+Inject a password encrypted using standard UNIX method.
+
+The passwrod will be used to authenticate user inside the application but it
+will not be transmit to any other database.
+
+=cut
+
+sub _InjectCryptPasswd {
+    my ($self, $cryptpasswd) = @_;
+
+    if (my $current = $self->get_field('userPassword')) {
+        if ($cryptpasswd eq $current) {
+            return 1;
+        }
+    }
+    my $res = $self->set_fields('userPassword', $cryptpasswd);
+
+    if ($res) {
+        $self->base->log(LA_NOTICE, 'Crypted password injected for %s', $self->id);
+        return 1;
+    } else {
+        $self->base->log(LA_ERR, 'Cannot inject crypted password for %s', $self->id);
+        return 0;
+    }
+}
 
 =head2 GenPasswordResetId

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Unix/User.pm

@@ -138 +138 @@
 }
 
+=head2 _InjectCryptPasswd($cryptpasswd)
+
+Inject a password encrypted using standard UNIX method.
+
+=cut
+
+sub _InjectCryptPasswd {
+    my ($self, $cryptpasswd) = @_;
+
+    my $res = $self->set_c_fields(
+        userPassword => $cryptpasswd,
+    );
+
+    if ($res) {
+        $self->base->log(LA_NOTICE, 'Crypted password injected for %s', $self->id);
+        return 1;
+    } else {
+        $self->base->log(LA_ERR, 'Cannot inject crypted password for %s', $self->id);
+        return 0;
+    }
+}
+
 1;