mirror of
https://github.com/ovh/the-bastion.git
synced 2024-09-20 15:05:58 +08:00
103 lines
3.1 KiB
Perl
Executable file
103 lines
3.1 KiB
Perl
Executable file
#! /usr/bin/perl -T
|
|
# vim: set filetype=perl ts=4 sw=4 sts=4 et:
|
|
# NEEDGROUP osh-accountUnlock
|
|
# SUDOERS %osh-accountUnlock ALL=(root) NOPASSWD:/usr/bin/env perl -T /opt/bastion/bin/helper/osh-accountUnlock *
|
|
# FILEMODE 0700
|
|
# FILEOWN 0 0
|
|
|
|
#>HEADER
|
|
use common::sense;
|
|
use Getopt::Long;
|
|
use File::Basename;
|
|
use lib dirname(__FILE__) . '/../../lib/perl';
|
|
use OVH::Result;
|
|
use OVH::Bastion;
|
|
use OVH::Bastion::Helper;
|
|
|
|
# Fetch command options
|
|
my $fnret;
|
|
my ($result, @optwarns);
|
|
my ($account);
|
|
eval {
|
|
local $SIG{__WARN__} = sub { push @optwarns, shift };
|
|
$result = GetOptions("account=s" => sub { $account //= $_[1] },);
|
|
};
|
|
if ($@) { die $@ }
|
|
|
|
if (!$result) {
|
|
local $" = ", ";
|
|
HEXIT('ERR_BAD_OPTIONS', msg => "Error parsing options: @optwarns");
|
|
}
|
|
if (!$account) {
|
|
HEXIT('ERR_MISSING_PARAMETER', msg => "Missing argument 'account'");
|
|
}
|
|
|
|
#<HEADER
|
|
#>RIGHTSCHECK
|
|
if ($self eq 'root') {
|
|
osh_debug "Real root, skipping checks of permissions";
|
|
}
|
|
else {
|
|
# need to perform another security check
|
|
$fnret = OVH::Bastion::is_user_in_group(
|
|
user => $self,
|
|
group => "osh-accountUnlock"
|
|
);
|
|
if (!$fnret) {
|
|
HEXIT('ERR_SECURITY_VIOLATION', msg => "You're not allowed to run this, dear $self");
|
|
}
|
|
}
|
|
|
|
#<RIGHTSCHECK
|
|
#>PARAMS:ACCOUNT
|
|
osh_debug("Checking account");
|
|
$fnret = OVH::Bastion::is_bastion_account_valid_and_existing(account => $account);
|
|
$fnret or HEXIT($fnret);
|
|
$account = $fnret->value->{'account'}; # untainted
|
|
|
|
#<PARAMS:ACCOUNT
|
|
|
|
osh_info("Attempting to unlock account... system helper output will follow.");
|
|
osh_info("\n");
|
|
|
|
# we need a list because we want to try in that specific order
|
|
my @programs = qw{ faillock pam_tally2 pam_tally };
|
|
my %cmds = (
|
|
faillock => [qw{ faillock --user }, $account],
|
|
pam_tally2 => [qw{ pam_tally2 -u }, $account, '-r'],
|
|
pam_tally => [qw{ pam_tally --user }, $account, '--reset'],
|
|
);
|
|
|
|
my $found;
|
|
foreach my $program (@programs) {
|
|
next if not $cmds{$program};
|
|
next if not OVH::Bastion::is_in_path(binary => $cmds{$program}[0]);
|
|
$found = $program;
|
|
last;
|
|
}
|
|
|
|
if (!$found) {
|
|
if (OVH::Bastion::is_linux()) {
|
|
warn_syslog("Couldn't unlock account $account, as neither faillock, pam_tally2 or pam_tally seem to be installed");
|
|
HEXIT('ERR_HELPER_MISSING', msg => "Found no unlock helper on this system. Please contact your sysadmin!");
|
|
}
|
|
else {
|
|
HEXIT('ERR_UNSUPPORTED_FEATURE', msg => "Can't unlock account, your system might not support it");
|
|
}
|
|
}
|
|
|
|
$fnret = OVH::Bastion::execute(cmd => $cmds{$found}, must_succeed => 1, noisy_stdout => 1, noisy_stderr => 1);
|
|
if (!$fnret) {
|
|
my $error = '(empty)';
|
|
if ($fnret->value->{'stderr'}) {
|
|
$error = $fnret->value->{'stderr'}[0];
|
|
}
|
|
elsif ($fnret->value->{'stdout'}) {
|
|
$error = $fnret->value->{'stdout'}[0];
|
|
}
|
|
warn_syslog("Got an error trying to unlock account $account through $found, first returned line was '$error'");
|
|
HEXIT R('ERR_INTERNAL', msg => "Failed to unlock $account");
|
|
}
|
|
|
|
HEXIT('OK', value => {account => $account}, msg => "Account '$account' has been successfully unlocked.");
|