# coding: utf-8 from Crypto.PublicKey import RSA from subprocess import call from juser.models import AdminGroup from jumpserver.api import * from jumpserver.settings import BASE_DIR def group_add_user(group, user_id=None, username=None): """ 用户组中添加用户 UserGroup Add a user """ if user_id: user = get_object(User, id=user_id) else: user = get_object(User, username=username) if user: group.user_set.add(user) def db_add_group(**kwargs): """ add a user group in database 数据库中添加用户组 """ name = kwargs.get('name') group = get_object(UserGroup, name=name) users = kwargs.pop('users_id') if not group: group = UserGroup(**kwargs) group.save() for user_id in users: group_add_user(group, user_id) def group_update_member(group_id, users_id_list): """ user group update member 用户组更新成员 """ group = get_object(UserGroup, id=group_id) if group: group.user_set.clear() for user_id in users_id_list: user = get_object(UserGroup, id=user_id) if isinstance(user, UserGroup): group.user_set.add(user) def db_add_user(**kwargs): """ add a user in database 数据库中添加用户 """ groups_post = kwargs.pop('groups') admin_groups = kwargs.pop('admin_groups') role = kwargs.get('role', 'CU') user = User(**kwargs) user.set_password(kwargs.get('password')) user.save() if groups_post: group_select = [] for group_id in groups_post: group = UserGroup.objects.filter(id=group_id) group_select.extend(group) user.group = group_select if admin_groups and role == 'GA': # 如果是组管理员就要添加组管理员和组到管理组中 for group_id in admin_groups: group = get_object(UserGroup, id=group_id) if group: AdminGroup(user=user, group=group).save() return user def db_update_user(**kwargs): """ update a user info in database 数据库更新用户信息 """ groups_post = kwargs.pop('groups') admin_groups_post = kwargs.pop('admin_groups') user_id = kwargs.pop('user_id') user = User.objects.get(id=user_id) if user: user.update(**kwargs) user.set_password(kwargs.pop('password')) user.save() else: return None group_select = [] if groups_post: for group_id in groups_post: group = UserGroup.objects.filter(id=group_id) group_select.extend(group) user.group = group_select if admin_groups_post != '': user.admingroup_set.all().delete() for group_id in admin_groups_post: group = get_object(UserGroup, id=group_id) AdminGroup(user=user, group=group).save() def db_del_user(username): """ delete a user from database 从数据库中删除用户 """ user = get_object(User, username=username) if user: user.delete() def gen_ssh_key(username, password='', key_dir=os.path.join(BASE_DIR, 'keys/user/'), authorized_keys=True, home="/home", length=2048): """ generate a user ssh key in a property dir 生成一个用户ssh密钥对 """ private_key_file = os.path.join(key_dir, username) if os.path.isfile(private_key_file): os.unlink(private_key_file) ret = bash('ssh-keygen -t rsa -f %s -b %s -P "%s"' % (private_key_file, length, password)) if authorized_keys: auth_key_dir = os.path.join(home, username, '.ssh') is_dir(auth_key_dir, username, mode=0700) authorized_key_file = os.path.join(auth_key_dir, 'authorized_keys') with open(private_key_file+'.pub') as pub_f: with open(authorized_key_file, 'w') as auth_f: auth_f.write(pub_f.read()) os.chmod(authorized_key_file, 0600) bash('chown %s:%s %s' % (username, username, authorized_key_file)) def server_add_user(username, password, ssh_key_pwd, ssh_key_login_need): """ add a system user in jumpserver 在jumpserver服务器上添加一个用户 """ bash("useradd '%s'; echo '%s'; echo '%s' | passwd --stdin '%s'" % (username, password, password, username)) if ssh_key_login_need: gen_ssh_key(username, ssh_key_pwd) def user_add_mail(user, kwargs): """ add user send mail 发送用户添加邮件 """ user_role = {'SU': u'超级管理员', 'GA': u'组管理员', 'CU': u'普通用户'} mail_title = u'恭喜你的跳板机用户 %s 添加成功 Jumpserver' % user.name mail_msg = u""" Hi, %s 您的用户名： %s 您的角色： %s 您的web登录密码： %s 您的ssh密钥文件密码： %s 密钥下载地址： %s/juser/down_key/?uuid=%s 说明： 请登陆后再下载密钥！ """ % (user.name, user.username, user_role.get(user.role, u'普通用户'), kwargs.get('password'), kwargs.get('ssh_key_pwd'), URL, user.uuid) send_mail(mail_title, mail_msg, MAIL_FROM, [user.email], fail_silently=False) def server_del_user(username): """ delete a user from jumpserver linux system 删除系统上的某用户 """ bash('userdel -r %s' % username) def get_display_msg(user, password, ssh_key_pwd, ssh_key_login_need, send_mail_need): if send_mail_need: msg = u'添加用户 %s 成功！ 用户密码已发送到 %s 邮箱！' % (user.name, user.email) return msg if ssh_key_login_need: msg = u""" 跳板机地址： %s 用户名：%s 密码：%s 密钥密码：%s 密钥下载url: %s/juser/down_key/?id=%s 该账号密码可以登陆web和跳板机。 """ % (URL, user.username, password, ssh_key_pwd, URL, user.id) else: msg = u""" 跳板机地址： %s \n 用户名：%s \n 密码：%s \n 该账号密码可以登陆web和跳板机。 """ % (URL, user.username, password) return msg # def ldap_add_user(username, ldap_pwd): # """ # add a user in ldap database # 在LDAP中添加用户 # """ # user_dn = "uid=%s,ou=People,%s" % (username, LDAP_BASE_DN) # password_sha512 = PyCrypt.gen_sha512(PyCrypt.random_pass(6), ldap_pwd) # user = get_object(User, username=username) # if not user: # raise ServerError(u'用户 %s 不存在' % username) # # user_attr = {'uid': [str(username)], # 'cn': [str(username)], # 'objectClass': ['account', 'posixAccount', 'top', 'shadowAccount'], # 'userPassword': ['{crypt}%s' % password_sha512], # 'shadowLastChange': ['16328'], # 'shadowMin': ['0'], # 'shadowMax': ['99999'], # 'shadowWarning': ['7'], # 'loginShell': ['/bin/bash'], # 'uidNumber': [str(user.id)], # 'gidNumber': [str(user.id)], # 'homeDirectory': [str('/home/%s' % username)]} # # group_dn = "cn=%s,ou=Group,%s" % (username, LDAP_BASE_DN) # group_attr = {'objectClass': ['posixGroup', 'top'], # 'cn': [str(username)], # 'userPassword': ['{crypt}x'], # 'gidNumber': [str(user.id)]} # # ldap_conn.add(user_dn, user_attr) # ldap_conn.add(group_dn, group_attr) # def ldap_del_user(username): # """ # delete a user in ldap database # 在ldap中删除某用户 # """ # user_dn = "uid=%s,ou=People,%s" % (username, LDAP_BASE_DN) # group_dn = "cn=%s,ou=Group,%s" % (username, LDAP_BASE_DN) # sudo_dn = 'cn=%s,ou=Sudoers,%s' % (username, LDAP_BASE_DN) # # ldap_conn.delete(user_dn) # ldap_conn.delete(group_dn) # ldap_conn.delete(sudo_dn)