mirror of
https://github.com/ovh/the-bastion.git
synced 2025-01-06 07:22:14 +08:00
121 lines
3.8 KiB
Perl
Executable file
121 lines
3.8 KiB
Perl
Executable file
#! /usr/bin/perl -T
|
|
# vim: set filetype=perl ts=4 sw=4 sts=4 et:
|
|
# KEYSUDOERS # as an owner, we can delete an egress key of the group
|
|
# KEYSUDOERS SUPEROWNERS, %%GROUP%-owner ALL=(keykeeper) NOPASSWD: /usr/bin/env perl -T %BASEPATH%/bin/helper/osh-groupDelEgressKey --group %GROUP% *
|
|
# FILEMODE 0750
|
|
# FILEOWN 0 keykeeper
|
|
|
|
#>HEADER
|
|
use common::sense;
|
|
use Getopt::Long qw(:config no_auto_abbrev no_ignore_case);
|
|
|
|
use File::Basename;
|
|
use lib dirname(__FILE__) . '/../../lib/perl';
|
|
use OVH::Bastion;
|
|
use OVH::Bastion::Helper;
|
|
use OVH::Result;
|
|
|
|
# Fetch command options
|
|
my $fnret;
|
|
my ($result, @optwarns);
|
|
my ($group, $id);
|
|
eval {
|
|
local $SIG{__WARN__} = sub { push @optwarns, shift };
|
|
$result = GetOptions(
|
|
"group=s" => sub { $group //= $_[1] }, # ignore subsequent --group on cmdline (anti-sudoers-override)
|
|
"id=s" => sub { $id //= $_[1] },
|
|
);
|
|
};
|
|
if ($@) { die $@ }
|
|
|
|
if (!$result) {
|
|
local $" = ", ";
|
|
HEXIT('ERR_BAD_OPTIONS', msg => "Error parsing options: @optwarns");
|
|
}
|
|
|
|
OVH::Bastion::Helper::check_spurious_args();
|
|
|
|
if (!$group || !$id) {
|
|
HEXIT('ERR_MISSING_PARAMETER', msg => "Missing argument 'group' or 'id'");
|
|
}
|
|
|
|
#<HEADER
|
|
|
|
#>PARAMS:GROUP
|
|
$fnret = OVH::Bastion::is_valid_group_and_existing(group => $group, groupType => "key");
|
|
$fnret or HEXIT($fnret);
|
|
|
|
# get returned untainted value
|
|
$group = $fnret->value->{'group'};
|
|
my $shortGroup = $fnret->value->{'shortGroup'};
|
|
|
|
#<PARAMS:GROUP
|
|
|
|
#>RIGHTSCHECK
|
|
if ($self eq 'root') {
|
|
osh_debug "Real root, skipping checks of permissions";
|
|
}
|
|
$fnret = OVH::Bastion::is_group_owner(account => $self, group => $shortGroup, superowner => 1, sudo => 1);
|
|
if (!$fnret) {
|
|
HEXIT('ERR_SECURITY_VIOLATION', msg => "You're not allowed to run this, dear $self");
|
|
}
|
|
|
|
#<RIGHTSCHECK
|
|
|
|
#>CODE
|
|
$fnret = OVH::Bastion::get_group_keys(group => $group);
|
|
$fnret or HEXIT($fnret);
|
|
|
|
my @matchingKeys = grep { $fnret->value->{'keys'}{$_}{'id'} eq $id } @{$fnret->value->{'sortedKeys'} || []};
|
|
|
|
if (!@matchingKeys) {
|
|
HEXIT('ERR_INVALID_PARAMETER', msg => "Couldn't find any key with the ID you specified ($id) in group $shortGroup");
|
|
}
|
|
|
|
my $keyToDelete = $matchingKeys[0];
|
|
my $key = $fnret->value->{'keys'}{$keyToDelete};
|
|
|
|
osh_info("We're about to delete the following key:\n");
|
|
OVH::Bastion::print_public_key(key => $key);
|
|
|
|
# get the path to the privkey
|
|
my $fileToDelete = $fnret->value->{'keys'}{$keyToDelete}{'fullpath'};
|
|
if (!-f $fileToDelete) {
|
|
warn_syslog("The file '$fileToDelete' doesn't exist while trying to delete this egress key from group $shortGroup");
|
|
HEXIT('ERR_INVALID_PARAMETER', msg => "Couldn't find the key file");
|
|
}
|
|
|
|
my @errors;
|
|
foreach my $file ($fileToDelete, "$fileToDelete.pub") {
|
|
push @errors, "Couldn't delete '$file' in groupDelEgressKey by $self ($!)" if !unlink($file);
|
|
}
|
|
|
|
if (@errors) {
|
|
warn_syslog($_) for @errors;
|
|
if (@errors == 2) {
|
|
HEXIT('ERR_INTERNAL', msg => "Couldn't delete the requested key, more information available in the system log");
|
|
}
|
|
HEXIT('ERR_INTERNAL',
|
|
msg => "Couldn't delete one of the files constituting the key, more information available in the system log");
|
|
}
|
|
|
|
OVH::Bastion::syslogFormatted(
|
|
severity => 'info',
|
|
type => 'group',
|
|
fields => [
|
|
[action => 'delete_egress_key'],
|
|
[group => $shortGroup],
|
|
[self => $self],
|
|
[key_id => $key->{'id'}],
|
|
[key_algo => $key->{'typecode'}],
|
|
[key_algo_family => $key->{'family'}],
|
|
[key_size => $key->{'size'}],
|
|
[key_fingerprint => $key->{'fingerprint'}],
|
|
[key_comment => $key->{'comment'}],
|
|
[key_mtime => $key->{'mtime'}],
|
|
[key_path => $key->{'fullpath'}],
|
|
[key_base64 => $key->{'base64'}],
|
|
]
|
|
);
|
|
|
|
HEXIT('OK', value => $key, msg => "Key $id has successfully been deleted from the $shortGroup group");
|