abc
+
-
+
-
-
-
-
-
- 主机
- 128
-
+
+
+
+
+
+ 主机
+ 128
+ 主机账号
diff --git a/server/www/teleport/webroot/app/base/controller.py b/server/www/teleport/webroot/app/base/controller.py
index c56e7e0..9552782 100644
--- a/server/www/teleport/webroot/app/base/controller.py
+++ b/server/www/teleport/webroot/app/base/controller.py
@@ -132,7 +132,7 @@ class TPBaseHandler(tornado.web.RequestHandler):
raise RuntimeError("invalid request mode.")
return TPE_NEED_LOGIN
else:
- if self._user['privilege'] & require_privilege != 0:
+ if (self._user['privilege'] & require_privilege) != 0:
return TPE_OK
if self._mode == self.MODE_HTTP:
diff --git a/server/www/teleport/webroot/app/controller/__init__.py b/server/www/teleport/webroot/app/controller/__init__.py
index 1b87667..51f39c9 100644
--- a/server/www/teleport/webroot/app/controller/__init__.py
+++ b/server/www/teleport/webroot/app/controller/__init__.py
@@ -22,8 +22,8 @@ from . import system
__all__ = ['controllers', 'fix_controller']
controllers = [
- # (r'/', index.IndexHandler),
- (r'/', user.UserListHandler),
+ (r'/', index.IndexHandler),
+ # (r'/', user.UserListHandler),
# ====================================================
# 控制台
@@ -121,10 +121,10 @@ controllers = [
(r'/asset/account-group', account.AccGroupListHandler),
# - 某个账号组的管理页面
(r'/asset/account-group/(.*)', account.AccGroupInfoHandler),
- # - [json] 添加/更新/删除/禁用/解禁 远程账号
+ # - [json] 添加/更新 远程账号
(r'/asset/update-account', account.DoUpdateAccountHandler),
- # - [json] 删除账号
- # (r'/asset/remove-account', account.DoRemoveAccountHandler),
+ # - [json] 禁用/解禁/删除 远程账号
+ (r'/asset/update-accounts', account.DoUpdateAccountsHandler),
# - [json] 获取账号列表
(r'/asset/get-accounts', account.DoGetAccountsHandler),
# - [json] 获取账号组列表（包括不超过5个组内成员）
diff --git a/server/www/teleport/webroot/app/controller/account.py b/server/www/teleport/webroot/app/controller/account.py
index 4b3bdbd..6e5bd1e 100644
--- a/server/www/teleport/webroot/app/controller/account.py
+++ b/server/www/teleport/webroot/app/controller/account.py
@@ -212,72 +212,93 @@ class DoUpdateAccountHandler(TPBaseJsonHandler):
return self.write_json(TPE_JSON_FORMAT)
try:
- action = args['action']
host_id = int(args['host_id'])
acc_id = int(args['acc_id'])
except:
log.e('\n')
return self.write_json(TPE_PARAM)
- if action == 'remove':
- err = account.remove_account(self, host_id, acc_id)
- return self.write_json(err)
- elif action == 'lock':
- err = account.update_account_state(self, host_id, acc_id, TP_STATE_DISABLED)
- return self.write_json(err)
- elif action == 'unlock':
- err = account.update_account_state(self, host_id, acc_id, TP_STATE_NORMAL)
- return self.write_json(err)
- elif action == 'update':
- try:
- param = dict()
- # args['id'] = int(args['id'])
- # args['host_id'] = int(args['host_id'])
- param['host_ip'] = args['param']['host_ip']
- param['router_ip'] = args['param']['router_ip']
- param['router_port'] = args['param']['router_port']
- param['protocol_type'] = int(args['param']['protocol'])
- param['protocol_port'] = int(args['param']['port'])
- param['auth_type'] = int(args['param']['auth_type'])
- param['username'] = args['param']['username'].strip()
- param['password'] = args['param']['password']
- param['pri_key'] = args['param']['pri_key'].strip()
- except:
- log.e('\n')
- return self.write_json(TPE_PARAM)
-
- if len(param['username']) == 0:
- return self.write_json(TPE_PARAM)
-
- if acc_id == -1:
- # 新增账号
- if param['auth_type'] == TP_AUTH_TYPE_PASSWORD and len(param['password']) == 0:
- return self.write_json(TPE_PARAM)
- elif param['auth_type'] == TP_AUTH_TYPE_PRIVATE_KEY and len(param['pri_key']) == 0:
- return self.write_json(TPE_PARAM)
-
- if param['auth_type'] == TP_AUTH_TYPE_PASSWORD and len(param['password']) > 0:
- code, ret_data = yield core_service_async_enc(param['password'])
- if code != TPE_OK:
- return self.write_json(code, '无法加密存储密码！')
- else:
- param['password'] = ret_data
- elif param['auth_type'] == TP_AUTH_TYPE_PRIVATE_KEY and len(param['pri_key']) > 0:
- code, ret_data = yield core_service_async_enc(param['pri_key'])
- if code != TPE_OK:
- return self.write_json(code, '无法加密存储私钥！')
- else:
- param['pri_key'] = ret_data
-
- if acc_id == -1:
- err, info = account.add_account(self, host_id, param)
- else:
- err = account.update_account(self, host_id, acc_id, param)
- info = {}
- return self.write_json(err, data=info)
- else:
+ try:
+ param = dict()
+ param['host_ip'] = args['param']['host_ip']
+ param['router_ip'] = args['param']['router_ip']
+ param['router_port'] = args['param']['router_port']
+ param['protocol_type'] = int(args['param']['protocol'])
+ param['protocol_port'] = int(args['param']['port'])
+ param['auth_type'] = int(args['param']['auth_type'])
+ param['username'] = args['param']['username'].strip()
+ param['password'] = args['param']['password']
+ param['pri_key'] = args['param']['pri_key'].strip()
+ except:
+ log.e('\n')
return self.write_json(TPE_PARAM)
+ if len(param['username']) == 0:
+ return self.write_json(TPE_PARAM)
+
+ if acc_id == -1:
+ # 新增账号
+ if param['auth_type'] == TP_AUTH_TYPE_PASSWORD and len(param['password']) == 0:
+ return self.write_json(TPE_PARAM)
+ elif param['auth_type'] == TP_AUTH_TYPE_PRIVATE_KEY and len(param['pri_key']) == 0:
+ return self.write_json(TPE_PARAM)
+
+ if param['auth_type'] == TP_AUTH_TYPE_PASSWORD and len(param['password']) > 0:
+ code, ret_data = yield core_service_async_enc(param['password'])
+ if code != TPE_OK:
+ return self.write_json(code, '无法加密存储密码！')
+ else:
+ param['password'] = ret_data
+ elif param['auth_type'] == TP_AUTH_TYPE_PRIVATE_KEY and len(param['pri_key']) > 0:
+ code, ret_data = yield core_service_async_enc(param['pri_key'])
+ if code != TPE_OK:
+ return self.write_json(code, '无法加密存储私钥！')
+ else:
+ param['pri_key'] = ret_data
+
+ if acc_id == -1:
+ err, info = account.add_account(self, host_id, param)
+ else:
+ err = account.update_account(self, host_id, acc_id, param)
+ info = {}
+
+ self.write_json(err, data=info)
+
+
+class DoUpdateAccountsHandler(TPBaseJsonHandler):
+ @tornado.gen.coroutine
+ def post(self):
+ ret = self.check_privilege(TP_PRIVILEGE_ACCOUNT | TP_PRIVILEGE_ACCOUNT_GROUP)
+ if ret != TPE_OK:
+ return
+
+ args = self.get_argument('args', None)
+ if args is None:
+ return self.write_json(TPE_PARAM)
+ try:
+ args = json.loads(args)
+ except:
+ return self.write_json(TPE_JSON_FORMAT)
+
+ try:
+ action = args['action']
+ host_id = int(args['host_id'])
+ accounts = args['accounts']
+ except:
+ log.e('\n')
+ return self.write_json(TPE_PARAM)
+
+ if action == 'remove':
+ err = account.remove_accounts(self, host_id, accounts)
+ return self.write_json(err)
+ elif action == 'lock':
+ err = account.update_accounts_state(self, host_id, accounts, TP_STATE_DISABLED)
+ return self.write_json(err)
+ elif action == 'unlock':
+ err = account.update_accounts_state(self, host_id, accounts, TP_STATE_NORMAL)
+ return self.write_json(err)
+ else:
+ return self.write_json(TPE_PARAM)
# class DoRemoveAccountHandler(TPBaseJsonHandler):
# def post(self):
diff --git a/server/www/teleport/webroot/app/controller/audit.py b/server/www/teleport/webroot/app/controller/audit.py
index fd91231..ea3ae64 100644
--- a/server/www/teleport/webroot/app/controller/audit.py
+++ b/server/www/teleport/webroot/app/controller/audit.py
@@ -45,7 +45,7 @@ def get_free_space_bytes(folder):
class RecordHandler(TPBaseHandler):
def get(self):
- ret = self.check_privilege(TP_PRIVILEGE_OPS_AUZ | TP_PRIVILEGE_AUDIT_AUZ | TP_PRIVILEGE_AUDIT_OPS_HISTORY)
+ ret = self.check_privilege(TP_PRIVILEGE_OPS | TP_PRIVILEGE_OPS_AUZ | TP_PRIVILEGE_AUDIT_AUZ | TP_PRIVILEGE_AUDIT_OPS_HISTORY)
if ret != TPE_OK:
return
@@ -66,7 +66,9 @@ class RecordHandler(TPBaseHandler):
class DoGetRecordsHandler(TPBaseJsonHandler):
def post(self):
- # return self.write_json(0, data=[])
+ ret = self.check_privilege(TP_PRIVILEGE_OPS | TP_PRIVILEGE_OPS_AUZ | TP_PRIVILEGE_AUDIT_AUZ | TP_PRIVILEGE_AUDIT_OPS_HISTORY)
+ if ret != TPE_OK:
+ return
args = self.get_argument('args', None)
if args is None:
diff --git a/server/www/teleport/webroot/app/controller/dashboard.py b/server/www/teleport/webroot/app/controller/dashboard.py
index 240b9dd..b3b92b2 100644
--- a/server/www/teleport/webroot/app/controller/dashboard.py
+++ b/server/www/teleport/webroot/app/controller/dashboard.py
@@ -1,9 +1,13 @@
# -*- coding: utf-8 -*-
-# import tornado.ioloop
+from app.const import *
from app.base.controller import TPBaseHandler
class IndexHandler(TPBaseHandler):
def get(self):
+ ret = self.check_privilege(TP_PRIVILEGE_LOGIN_WEB)
+ if ret != TPE_OK:
+ return
+
self.render('dashboard/index.mako')
diff --git a/server/www/teleport/webroot/app/controller/index.py b/server/www/teleport/webroot/app/controller/index.py
index c36ced5..c3e26b5 100644
--- a/server/www/teleport/webroot/app/controller/index.py
+++ b/server/www/teleport/webroot/app/controller/index.py
@@ -9,7 +9,17 @@ from tornado.escape import json_encode
class IndexHandler(TPBaseHandler):
def get(self):
- # self.redirect('/system/role')
+ ret = self.check_privilege(TP_PRIVILEGE_LOGIN_WEB)
+ if ret != TPE_OK:
+ return
+
+ up = self._user['privilege']
+
+ if (up & TP_PRIVILEGE_SYS_CONFIG) != 0:
+ return self.redirect('/dashboard')
+ elif (up & TP_PRIVILEGE_OPS) != 0:
+ return self.redirect('/ops/remote')
+
self.redirect('/user/me')
diff --git a/server/www/teleport/webroot/app/model/account.py b/server/www/teleport/webroot/app/model/account.py
index aff460b..a96d855 100644
--- a/server/www/teleport/webroot/app/model/account.py
+++ b/server/www/teleport/webroot/app/model/account.py
@@ -225,7 +225,7 @@ def update_account(handler, host_id, acc_id, args):
db = get_db()
# 1. 判断是否存在
- sql = 'SELECT id FROM {}acc WHERE id={};'.format(db.table_prefix, acc_id)
+ sql = 'SELECT id FROM {}acc WHERE host_id={host_id} AND id={acc_id};'.format(db.table_prefix, host_id=host_id, acc_id=acc_id)
db_ret = db.query(sql)
if db_ret is None or len(db_ret) == 0:
return TPE_NOT_EXISTS
@@ -254,28 +254,29 @@ def update_account(handler, host_id, acc_id, args):
return TPE_OK
-def update_account_state(handler, host_id, acc_id, state):
+def update_accounts_state(handler, host_id, acc_ids, state):
db = get_db()
+ acc_ids = ','.join([str(uid) for uid in acc_ids])
# 1. 判断是否存在
- sql = 'SELECT id FROM {}acc WHERE host_id={host_id} AND id={acc_id};'.format(db.table_prefix, host_id=host_id, acc_id=acc_id)
+ sql = 'SELECT id FROM {}acc WHERE host_id={host_id} AND id IN ({ids});'.format(db.table_prefix, host_id=host_id, ids=acc_ids)
db_ret = db.query(sql)
if db_ret is None or len(db_ret) == 0:
return TPE_NOT_EXISTS
sql_list = []
- sql = 'UPDATE `{}acc` SET state={state} WHERE id={acc_id};' \
- ''.format(db.table_prefix, state=state, acc_id=acc_id)
+ sql = 'UPDATE `{}acc` SET state={state} WHERE id IN ({ids});' \
+ ''.format(db.table_prefix, state=state, ids=acc_ids)
sql_list.append(sql)
# sync to update the ops-audit table.
- sql = 'UPDATE `{}ops_auz` SET state={state} WHERE rtype={rtype} AND rid={rid};' \
- ''.format(db.table_prefix, state=state, rtype=TP_ACCOUNT, rid=acc_id)
+ sql = 'UPDATE `{}ops_auz` SET state={state} WHERE rtype={rtype} AND rid IN ({rid});' \
+ ''.format(db.table_prefix, state=state, rtype=TP_ACCOUNT, rid=acc_ids)
sql_list.append(sql)
- sql = 'UPDATE `{}ops_map` SET a_state={state} WHERE a_id={acc_id};' \
- ''.format(db.table_prefix, state=state, acc_id=acc_id)
+ sql = 'UPDATE `{}ops_map` SET a_state={state} WHERE a_id IN ({acc_id});' \
+ ''.format(db.table_prefix, state=state, acc_id=acc_ids)
sql_list.append(sql)
if db.transaction(sql_list):
@@ -284,48 +285,74 @@ def update_account_state(handler, host_id, acc_id, state):
return TPE_DATABASE
-def remove_account(handler, host_id, acc_id):
+def remove_accounts(handler, host_id, acc_ids):
"""
- 删除一个远程账号
+ 删除远程账号
"""
db = get_db()
+ acc_count = len(acc_ids)
+ print(acc_count)
+ acc_ids = ','.join([str(uid) for uid in acc_ids])
- # 1. 判断是否存在
s = SQL(db)
- s.select_from('acc', ['host_ip', 'router_ip', 'router_port', 'username'], alt_name='a')
- s.where('a.id={} AND a.host_id={}'.format(acc_id, host_id))
+ # 1. 判断是否存在
+ s.select_from('host', ['acc_count'], alt_name='a')
+ s.where('a.id={h_id}'.format(h_id=host_id, ids=acc_ids))
+ err = s.query()
+ if err != TPE_OK:
+ return err
+ if len(s.recorder) == 0:
+ return TPE_NOT_EXISTS
+ print(s.recorder)
+
+
+
+ s.reset().select_from('acc', ['host_ip', 'router_ip', 'router_port', 'username'], alt_name='a')
+ s.where('a.host_id={h_id} AND a.id IN ({ids}) '.format(h_id=host_id, ids=acc_ids))
err = s.query()
if err != TPE_OK:
return err
if len(s.recorder) == 0:
return TPE_NOT_EXISTS
- acc_name = '{}@{}'.format(s.recorder[0]['username'], s.recorder[0]['host_ip'])
- if len(s.recorder[0]['router_ip']) > 0:
- acc_name += '（由{}:{}路由）'.format(s.recorder[0]['router_ip'], s.recorder[0]['router_port'])
+ acc_names = []
+ for a in s.recorder:
+ acc_name = '{}@{}'.format(a.username, a.host_ip)
+ if len(a.router_ip) > 0:
+ acc_name += '（由{}:{}路由）'.format(a.router_ip, a.router_port)
+ acc_names.append(acc_name)
sql_list = []
- sql = 'DELETE FROM `{}group_map` WHERE type={} AND mid={};'.format(db.table_prefix, TP_GROUP_ACCOUNT, acc_id)
+ sql = 'DELETE FROM `{}acc` WHERE host_id={} AND id IN ({});'.format(db.table_prefix, host_id, acc_ids)
sql_list.append(sql)
- sql = 'DELETE FROM `{}acc` WHERE id={} AND host_id={};'.format(db.table_prefix, acc_id, host_id)
+ sql = 'DELETE FROM `{}group_map` WHERE type={} AND mid IN ({});'.format(db.table_prefix, TP_GROUP_ACCOUNT, acc_ids)
sql_list.append(sql)
# 更新主机相关账号数量
- sql = 'UPDATE `{}host` SET acc_count=acc_count-1 WHERE id={host_id};'.format(db.table_prefix, host_id=host_id)
+ sql = 'UPDATE `{}host` SET acc_count=acc_count-{acc_count} WHERE id={host_id};'.format(db.table_prefix, acc_count=acc_count, host_id=host_id)
sql_list.append(sql)
- sql = 'DELETE FROM `{}ops_auz` WHERE rtype={rtype} AND rid={rid};'.format(db.table_prefix, rtype=TP_ACCOUNT, rid=acc_id)
+ sql = 'DELETE FROM `{}ops_auz` WHERE rtype={rtype} AND rid IN ({rid});'.format(db.table_prefix, rtype=TP_ACCOUNT, rid=acc_ids)
sql_list.append(sql)
- sql = 'DELETE FROM `{}ops_map` WHERE a_id={acc_id};'.format(db.table_prefix, acc_id=acc_id)
+ sql = 'DELETE FROM `{}ops_map` WHERE a_id IN ({acc_id});'.format(db.table_prefix, acc_id=acc_ids)
sql_list.append(sql)
if not db.transaction(sql_list):
return TPE_DATABASE
- syslog.sys_log(handler.get_current_user(), handler.request.remote_ip, TPE_OK, "删除账号：{}".format(acc_name))
+ s.reset().select_from('host', ['acc_count'], alt_name='a')
+ s.where('a.id={h_id}'.format(h_id=host_id, ids=acc_ids))
+ err = s.query()
+ if err != TPE_OK:
+ return err
+ if len(s.recorder) == 0:
+ return TPE_NOT_EXISTS
+ print(s.recorder)
+
+ syslog.sys_log(handler.get_current_user(), handler.request.remote_ip, TPE_OK, "删除账号：{}".format('，'.join(acc_names)))
return TPE_OK
diff --git a/server/www/teleport/webroot/app/model/host.py b/server/www/teleport/webroot/app/model/host.py
index 44b0836..f62c4d9 100644
--- a/server/www/teleport/webroot/app/model/host.py
+++ b/server/www/teleport/webroot/app/model/host.py
@@ -229,7 +229,7 @@ def update_host(handler, args):
sql_list.append(sql)
# 更新所有此主机相关的账号
- sql = 'UPDATE `{}acc` SET ip="{ip}", router_ip="{router_ip}", router_port={router_port} WHERE host_id={id};' \
+ sql = 'UPDATE `{}acc` SET host_ip="{ip}", router_ip="{router_ip}", router_port={router_port} WHERE host_id={id};' \
''.format(db.table_prefix,
ip=args['ip'], router_ip=args['router_ip'], router_port=args['router_port'], id=args['id'])
sql_list.append(sql)