diff --git a/apps/assets/automations/change_password/database/change_password_mysql/main.yml b/apps/assets/automations/change_password/database/change_password_mysql/main.yml index 483554a1e..b42251300 100644 --- a/apps/assets/automations/change_password/database/change_password_mysql/main.yml +++ b/apps/assets/automations/change_password/database/change_password_mysql/main.yml @@ -1,29 +1,46 @@ -- hosts: demo +- hosts: mysql + gather_facts: no + vars: + ansible_python_interpreter: /usr/local/bin/python + jms_account: + username: root + password: redhat + jms_asset: + address: 127.0.0.1 + port: 3306 + account: + username: web1 + password: jumpserver + tasks: - - name: ping - ping: + - name: Test MySQL connection + community.mysql.mysql_info: + login_user: "{{ jms_account.username }}" + login_password: "{{ jms_account.secret }}" + login_host: "{{ jms_asset.address }}" + login_port: "{{ jms_asset.port }}" + filter: version + register: db_info - #- name: print variables - # debug: - # msg: "Username: {{ account.username }}, Password: {{ account.password }}" + - name: MySQL version + debug: + var: db_info.version.full - - name: Change password - user: + - name: Change MySQL password + community.mysql.mysql_user: + login_user: "{{ jms_account.username }}" + login_password: "{{ jms_account.secret }}" + login_host: "{{ jms_asset.address }}" + login_port: "{{ jms_asset.port }}" name: "{{ account.username }}" - password: "{{ account.password | password_hash('des') }}" - update_password: always - when: account.password - - - name: Change public key - authorized_key: - user: "{{ account.username }}" - key: "{{ account.public_key }}" - state: present - when: account.public_key + password: "{{ account.secret }}" + host: "%" + when: db_info is succeeded - name: Verify password - ping: - vars: - ansible_user: "{{ account.username }}" - ansible_pass: "{{ account.password }}" - ansible_ssh_connection: paramiko + community.mysql.mysql_info: + login_user: "{{ account.username }}" + login_password: "{{ account.secret }}" + login_host: "{{ jms_asset.address }}" + login_port: "{{ jms_asset.port }}" + filter: version diff --git a/apps/assets/automations/change_password/database/change_password_postgresql/main.yml b/apps/assets/automations/change_password/database/change_password_postgresql/main.yml index 402c7fa8d..0180c559c 100644 --- a/apps/assets/automations/change_password/database/change_password_postgresql/main.yml +++ b/apps/assets/automations/change_password/database/change_password_postgresql/main.yml @@ -1,10 +1,45 @@ -{% for account in accounts %} -- hosts: {{ account.asset.name }} +- hosts: mysql + gather_facts: no vars: + ansible_python_interpreter: /usr/local/bin/python + jms_account: + username: postgre + password: postgre + jms_asset: + address: 127.0.0.1 + port: 5432 account: - username: {{ account.username }} - password: {{ account.password }} - public_key: {{ account.public_key }} - roles: - - change_password -{% endfor %} + username: web1 + secret: jumpserver + + tasks: + - name: Test PostgreSQL connection + community.postgresql.postgresql_info: + login_user: "{{ jms_account.username }}" + login_password: "{{ jms_account.secret }}" + login_host: "{{ jms_asset.address }}" + login_port: "{{ jms_asset.port }}" + register: db_info + + - name: Display PostgreSQL version + debug: + var: db_info.version.full + + - name: Change PostgreSQL password + community.postgresql.postgresql_user: + login_user: "{{ jms_account.username }}" + login_password: "{{ jms_account.secret }}" + login_host: "{{ jms_asset.address }}" + login_port: "{{ jms_asset.port }}" + name: "{{ account.username }}" + password: "{{ account.secret }}" + comment: Updated by jumpserver + state: present + when: db_info is succeeded + + - name: Verify password + community.postgresql.postgresql_info: + login_user: "{{ account.username }}" + login_password: "{{ account.secret }}" + login_host: "{{ jms_asset.address }}" + login_port: "{{ jms_asset.port }}" diff --git a/apps/assets/automations/change_password/database/change_password_postgresql/roles/change_password/tasks/main.yml b/apps/assets/automations/change_password/database/change_password_postgresql/roles/change_password/tasks/main.yml deleted file mode 100644 index 903cd9115..000000000 --- a/apps/assets/automations/change_password/database/change_password_postgresql/roles/change_password/tasks/main.yml +++ /dev/null @@ -1,27 +0,0 @@ -- name: ping - ping: - -#- name: print variables -# debug: -# msg: "Username: {{ account.username }}, Password: {{ account.password }}" - -- name: Change password - user: - name: "{{ account.username }}" - password: "{{ account.password | password_hash('des') }}" - update_password: always - when: account.password - -- name: Change public key - authorized_key: - user: "{{ account.username }}" - key: "{{ account.public_key }}" - state: present - when: account.public_key - -- name: Verify password - ping: - vars: - ansible_user: "{{ account.username }}" - ansible_pass: "{{ account.password }}" - ansible_ssh_connection: paramiko diff --git a/apps/ops/ansible/inventory.py b/apps/ops/ansible/inventory.py index 42cd7320c..9d4498515 100644 --- a/apps/ops/ansible/inventory.py +++ b/apps/ops/ansible/inventory.py @@ -62,13 +62,16 @@ class JMSInventory: def asset_to_host(self, asset, account, automation, protocols): host = { 'name': asset.name, - 'asset': { + 'jms_asset': { 'id': str(asset.id), 'name': asset.name, 'address': asset.address, 'type': asset.type, 'category': asset.category, 'protocol': asset.protocol, 'port': asset.port, 'protocols': [{'name': p.name, 'port': p.port} for p in protocols], }, - 'exclude': '' + 'jms_account': { + 'id': str(account.id), 'username': account.username, + 'secret': account.secret, 'secret_type': account.secret_type + } if account else None } ansible_connection = automation.ansible_config.get('ansible_connection', 'ssh') gateway = None diff --git a/apps/orgs/models.py b/apps/orgs/models.py index d5e3ae617..7c7babd76 100644 --- a/apps/orgs/models.py +++ b/apps/orgs/models.py @@ -78,7 +78,9 @@ class Organization(OrgRoleMixin, models.Model): ROOT_ID = '00000000-0000-0000-0000-000000000000' ROOT_NAME = _('GLOBAL') DEFAULT_ID = '00000000-0000-0000-0000-000000000002' - DEFAULT_NAME = 'Default' + DEFAULT_NAME = _('DEFAULT') + SYSTEM_ID = '00000000-0000-0000-0000-000000000004' + SYSTEM_NAME = _('SYSTEM') orgs_mapping = None class Meta: diff --git a/apps/perms/urls/asset_permission.py b/apps/perms/urls/asset_permission.py index 0ef87f606..cc8e10f36 100644 --- a/apps/perms/urls/asset_permission.py +++ b/apps/perms/urls/asset_permission.py @@ -65,7 +65,7 @@ user_permission_urlpatterns = [ path('assets//accounts/', api.MyGrantedAssetAccountsApi.as_view(), name='my-asset-accounts'), # 用户登录资产的特殊账号, @INPUT, @USER 等 path('/assets/special-accounts/', api.UserGrantedAssetSpecialAccountsApi.as_view(), name='user-special-accounts'), - path('/assets/special-accounts/', api.MyGrantedAssetSpecialAccountsApi.as_view(), name='my-special-accounts'), + path('assets/special-accounts/', api.MyGrantedAssetSpecialAccountsApi.as_view(), name='my-special-accounts'), ] user_group_permission_urlpatterns = [