shim.py

#! /usr/bin/env python

# Userify Shim
# Copyright (c) 2012-2014 Userify

# Note: the shim can be easily installed and configured via the shim installer,
# or just installed manually after creating the creds.py file.

# base level imports

try:
    import json
except:
    import simplejson as json

# Standard Library Imports
import subprocess
import os
import os.path
import signal
import httplib
import sys
import datetime
import time
import traceback
import base64
import urllib
# catch stderr
from subprocess import PIPE as pipe

sys.path.append("/opt/userify")
from creds import api_id, api_key
local_download = urllib.urlretrieve

def userdel(username, permanent=False):
    # removes user and renames homedir
    removed_dir = "/home/deleted:" + username
    home_dir = "/home/" + username
    if not permanent:
        if os.path.isdir(removed_dir):
            qexec(["/bin/rm", "-Rf", removed_dir])
        # Debian:
        qexec(["/usr/bin/pkill", "--signal", "9", "-u", username])
        # RHEL:
        qexec(["/usr/bin/pkill", "-9", "-u", username])
        qexec(["/usr/sbin/userdel", username])
        qexec(["/bin/mv", home_dir, removed_dir])
    else:
        qexec(["/usr/sbin/userdel", "-r", username])

def useradd(name, username, preferred_shell):
    removed_dir = "/home/deleted:" + username
    home_dir = "/home/" + username
    # restore removed home directory
    if not os.path.isdir(home_dir) and os.path.isdir(removed_dir):
        qexec(["/bin/mv", removed_dir, home_dir])
    cmd = ["/usr/sbin/useradd", "-m"
            if not os.path.isdir(home_dir) else "",
        "--comment", "userify-" + name,
        "-s", preferred_shell if preferred_shell else "/bin/bash",
        "--user-group", username]
    subprocess.call([i for i in cmd if i])
    parse_passwd()

def sudoers_add(username, perm=""):
    fname = "/etc/sudoers.d/" + username
    text = sudoerstext(username, perm)
    if perm:
        if not os.path.isfile(fname) or open(fname).read() != text:
            open(fname, "w").write(text)
            fullchmod("0440", fname)
    else:
        sudoers_del(username)

def sudoers_del(username):
    fname = "/etc/sudoers.d/" + username
    if os.path.isfile(fname):
        qexec(["/bin/rm", fname])

def sudoerstext(username, perm):
    return "\n".join((
        "# Generated by userify",
        username + " "*10 + perm, ""))

def sshkeytext(ssh_public_key):
    return "\n".join((
        "# Generated by userify",
        "# Paste your new key at console.userify.com.", ssh_public_key, ""))

def sshkey_add(username, ssh_public_key):
    userpath = "/home/" + username
    sshpath = userpath + "/.ssh/"
    failsafe_mkdir(sshpath)
    fname = sshpath + "authorized_keys"
    text = sshkeytext(ssh_public_key)
    if not os.path.isfile(fname) or open(fname).read() != text:
        open(fname, "w").write(text)
        fullchown(username, sshpath)

def fullchown(username, path):
    qexec(["chown", "-R", username+":"+username, path])

def fullchmod(mode, path):
    qexec(["chmod", "-R", mode, path])

def qexec(cmd):
    print "[shim] exec: \"" + " ".join(cmd) + '"'
    try: subprocess.check_call(cmd)
         # ,stderr=pipe, stdout=pipe)
    except:
        traceback.print_exc()
        pass

def failsafe_mkdir(path):
    try: os.mkdir(path)
    except OSError: pass

def auth(id,key):
    return base64.b64encode(":".join((api_id, api_key)))

def https(method, path, data=""):
    h = httplib.HTTPSConnection("configure.userify.com", timeout=30)
    headers = {
        "Accept": "text/plain, */json",
        "Authorization": "Basic " + auth(api_id, api_key)
    }
    h.request(method, path, data, headers)
    return h

def parse_passwd():
    # returns a list of passwd lines, ordered as
    # username, unused, uid, gid, comment, homedir, shell
    app["passwd"] = [[i.strip() for i in l.split(":")]
        for l in open("/etc/passwd").read().strip().split("\n")]
    app["passwd"] = [i if len(i)>6 else i.append("") for i in app["passwd"]]

def current_usernames():
    return [user[0] for user in app["passwd"]]

def current_userify_users():
    "get only usernames created by userify"
    return [user for user in app["passwd"] if user[4].startswith("userify-")]

def remove_user(username, permanent=False):
    # completely removes user
    try: userdel(username, permanent)
    except: pass
    try: sudoers_del(username)
    except: pass

def process_users(good_users):
    for username, user in good_users.iteritems():
        if username not in current_usernames():
            useradd(user["name"], username, user["preferred_shell"])
        sshkey_add(username, user["ssh_public_key"])
        sudoers_add(username, user["perm"])
    for userrow in current_userify_users():
        username = userrow[0]
        if username not in good_users.keys():
            print "[shim] removing" + username
            remove_user(username)

def main():
    parse_passwd()
    h = https("POST", "/api/userify/configure")
    response = h.getresponse()
    # print response.status, response.reason
    commands = json.loads(response.read())
    if "error" in commands:
        return
    process_users(commands["users"])
    return commands["shim-delay"] if "shim-delay" in commands else 1


app = {}
try:
    print "[shim] start: %s" % time.ctime()
    s = time.time()
    time_to_wait = main()
    elapsed = time.time() - s
    print "[shim] elapsed: " + str(int(elapsed * 1000)/1000.0) + "s"
    if elapsed < time_to_wait:
        print "[shim] sleeping: %s" % (time_to_wait-elapsed)
        time.sleep(time_to_wait-elapsed)
except:
    time.sleep(1)
    raise