perf: 修改 ansible change password

apps/assets/automations/change_password/database/change_password_mysql/main.yml

@@ -1,29 +1,46 @@
-- hosts: demo
+- hosts: mysql
+  gather_facts: no
+  vars:
+    ansible_python_interpreter: /usr/local/bin/python
+    jms_account:
+      username: root
+      password: redhat
+    jms_asset:
+      address: 127.0.0.1
+      port: 3306
+    account:
+      username: web1
+      password: jumpserver
+
   tasks:
-    - name: ping
-      ping:
+    - name: Test MySQL connection
+      community.mysql.mysql_info:
+        login_user: "{{ jms_account.username }}"
+        login_password: "{{ jms_account.secret }}"
+        login_host: "{{ jms_asset.address }}"
+        login_port: "{{ jms_asset.port }}"
+        filter: version
+      register: db_info
 
-    #- name: print variables
-    #  debug:
-    #    msg: "Username: {{ account.username }}, Password: {{ account.password }}"
+    - name: MySQL version
+      debug:
+        var: db_info.version.full
 
-    - name: Change password
-      user:
+    - name: Change MySQL password
+      community.mysql.mysql_user:
+        login_user: "{{ jms_account.username }}"
+        login_password: "{{ jms_account.secret }}"
+        login_host: "{{ jms_asset.address }}"
+        login_port: "{{ jms_asset.port }}"
         name: "{{ account.username }}"
-        password: "{{ account.password | password_hash('des') }}"
-        update_password: always
-      when: account.password
-
-    - name: Change public key
-      authorized_key:
-        user: "{{ account.username }}"
-        key: "{{ account.public_key }}"
-        state: present
-      when: account.public_key
+        password: "{{ account.secret }}"
+        host: "%"
+      when: db_info is succeeded
 
     - name: Verify password
-      ping:
-      vars:
-        ansible_user: "{{ account.username }}"
-        ansible_pass: "{{ account.password }}"
-        ansible_ssh_connection: paramiko
+      community.mysql.mysql_info:
+        login_user: "{{ account.username }}"
+        login_password: "{{ account.secret }}"
+        login_host: "{{ jms_asset.address }}"
+        login_port: "{{ jms_asset.port }}"
+        filter: version

apps/assets/automations/change_password/database/change_password_postgresql/main.yml

@@ -1,10 +1,45 @@
-{% for account in accounts %}
-- hosts: {{ account.asset.name }}
+- hosts: mysql
+  gather_facts: no
   vars:
+    ansible_python_interpreter: /usr/local/bin/python
+    jms_account:
+      username: postgre
+      password: postgre
+    jms_asset:
+      address: 127.0.0.1
+      port: 5432
     account:
-      username: {{ account.username }}
-      password: {{ account.password }}
-      public_key: {{ account.public_key }}
-  roles:
-    - change_password
-{% endfor %}
+      username: web1
+      secret: jumpserver
+
+  tasks:
+    - name: Test PostgreSQL connection
+      community.postgresql.postgresql_info:
+        login_user: "{{ jms_account.username }}"
+        login_password: "{{ jms_account.secret }}"
+        login_host: "{{ jms_asset.address }}"
+        login_port: "{{ jms_asset.port }}"
+      register: db_info
+
+    - name: Display PostgreSQL version
+      debug:
+        var: db_info.version.full
+
+    - name: Change PostgreSQL password
+      community.postgresql.postgresql_user:
+        login_user: "{{ jms_account.username }}"
+        login_password: "{{ jms_account.secret }}"
+        login_host: "{{ jms_asset.address }}"
+        login_port: "{{ jms_asset.port }}"
+        name: "{{ account.username }}"
+        password: "{{ account.secret }}"
+        comment: Updated by jumpserver
+        state: present
+      when: db_info is succeeded
+
+    - name: Verify password
+      community.postgresql.postgresql_info:
+        login_user: "{{ account.username }}"
+        login_password: "{{ account.secret }}"
+        login_host: "{{ jms_asset.address }}"
+        login_port: "{{ jms_asset.port }}"

apps/assets/automations/change_password/database/change_password_postgresql/roles/change_password/tasks/main.yml

@@ -1,27 +0,0 @@
-- name: ping
-  ping:
-
-#- name: print variables
-#  debug:
-#    msg: "Username: {{ account.username }}, Password: {{ account.password }}"
-
-- name: Change password
-  user:
-    name: "{{ account.username }}"
-    password: "{{ account.password | password_hash('des') }}"
-    update_password: always
-  when: account.password
-
-- name: Change public key
-  authorized_key:
-    user: "{{ account.username }}"
-    key: "{{ account.public_key }}"
-    state: present
-  when: account.public_key
-
-- name: Verify password
-  ping:
-  vars:
-    ansible_user: "{{ account.username }}"
-    ansible_pass: "{{ account.password }}"
-    ansible_ssh_connection: paramiko

apps/ops/ansible/inventory.py

@@ -62,13 +62,16 @@ class JMSInventory:
     def asset_to_host(self, asset, account, automation, protocols):
         host = {
             'name': asset.name,
-            'asset': {
+            'jms_asset': {
                 'id': str(asset.id), 'name': asset.name, 'address': asset.address,
                 'type': asset.type, 'category': asset.category,
                 'protocol': asset.protocol, 'port': asset.port,
                 'protocols': [{'name': p.name, 'port': p.port} for p in protocols],
             },
-            'exclude': ''
+            'jms_account':  {
+                'id': str(account.id), 'username': account.username,
+                'secret': account.secret, 'secret_type': account.secret_type
+            } if account else None
         }
         ansible_connection = automation.ansible_config.get('ansible_connection', 'ssh')
         gateway = None

apps/orgs/models.py

@@ -78,7 +78,9 @@ class Organization(OrgRoleMixin, models.Model):
     ROOT_ID = '00000000-0000-0000-0000-000000000000'
     ROOT_NAME = _('GLOBAL')
     DEFAULT_ID = '00000000-0000-0000-0000-000000000002'
-    DEFAULT_NAME = 'Default'
+    DEFAULT_NAME = _('DEFAULT')
+    SYSTEM_ID = '00000000-0000-0000-0000-000000000004'
+    SYSTEM_NAME = _('SYSTEM')
     orgs_mapping = None
 
     class Meta:

apps/perms/urls/asset_permission.py

@@ -65,7 +65,7 @@ user_permission_urlpatterns = [
     path('assets/<uuid:asset_id>/accounts/', api.MyGrantedAssetAccountsApi.as_view(), name='my-asset-accounts'),
     # 用户登录资产的特殊账号, @INPUT, @USER 等
     path('<uuid:pk>/assets/special-accounts/', api.UserGrantedAssetSpecialAccountsApi.as_view(), name='user-special-accounts'),
-    path('/assets/special-accounts/', api.MyGrantedAssetSpecialAccountsApi.as_view(), name='my-special-accounts'),
+    path('assets/special-accounts/', api.MyGrantedAssetSpecialAccountsApi.as_view(), name='my-special-accounts'),
 ]
 
 user_group_permission_urlpatterns = [