* Created tools/anvil-manage-keys to handle user requests to remove bad keys from known_hosts files for target machines that have been rebuilt or replaced.
* Added a check to Remote->call() where, when a connect attempt fails because of a changed/bad key, it is reported as such to the user/logs and an entry is recorded in the state file. * Started adding a Striker menu function showing users a list of bad keys in known_hosts files and the ability to remove old keys. Signed-off-by: Digimer <digimer@alteeve.ca>main
Digimer
5 years ago
parent
37f36fe99c
commit
566ec896ca
11 changed files with 537 additions and 23 deletions
|
After Width: | Height: | Size: 20 KiB |
|
After Width: | Height: | Size: 21 KiB |
@ -0,0 +1,268 @@ |
||||
#!/usr/bin/perl |
||||
# |
||||
# This removes a bad key from a |
||||
# |
||||
# This program is setuid 'admin' and calls a (new) peer to read its hostname and system UUID. It takes the |
||||
# target's password in via a file. |
||||
# |
||||
# Exit codes; |
||||
# 0 = Normal exit. |
||||
# 1 = No database connection. |
||||
# 2 = No offending keys found. |
||||
# 3 = |
||||
# |
||||
|
||||
use strict; |
||||
use warnings; |
||||
use Anvil::Tools; |
||||
|
||||
my $THIS_FILE = ($0 =~ /^.*\/(.*)$/)[0]; |
||||
my $running_directory = ($0 =~ /^(.*?)\/$THIS_FILE$/)[0]; |
||||
if (($running_directory =~ /^\./) && ($ENV{PWD})) |
||||
{ |
||||
$running_directory =~ s/^\./$ENV{PWD}/; |
||||
} |
||||
|
||||
# Turn off buffering so that the pinwheel will display while waiting for the SSH call(s) to complete. |
||||
$| = 1; |
||||
|
||||
my $anvil = Anvil::Tools->new(); |
||||
$anvil->Log->level({set => 2}); |
||||
$anvil->Log->secure({set => 1}); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, level => 2, secure => 0, key => "log_0115", variables => { program => $THIS_FILE }}); |
||||
|
||||
# Read switches (target ([user@]host[:port]) and the file with the target's password. If the password is |
||||
# passed directly, it will be used. Otherwise, the password will be read from the database. |
||||
$anvil->Get->switches; |
||||
|
||||
$anvil->Database->connect(); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, level => 3, secure => 0, key => "log_0132"}); |
||||
if (not $anvil->data->{sys}{database}{connections}) |
||||
{ |
||||
# No databases, update the job, sleep for a bit and then exit. The daemon will pick it up and try |
||||
# again after we exit. |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 0, priority => "err", key => "error_0077"}); |
||||
sleep 10; |
||||
$anvil->nice_exit({exit_code => 1}); |
||||
} |
||||
|
||||
### TODO: Store the state_uuid(s) of the key(s) to remove. |
||||
# If we don't have a state_uuid, pick it up from the job_data |
||||
|
||||
# Read in the details and make sure the bad the bad key is on our system. |
||||
my $query = "SELECT |
||||
state_uuid, |
||||
state_name, |
||||
state_note |
||||
FROM |
||||
states |
||||
WHERE |
||||
state_host_uuid = ".$anvil->Database->quote($anvil->data->{sys}{host_uuid})." |
||||
AND |
||||
state_name LIKE 'host_key_changed::%' |
||||
;"; |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { query => $query }}); |
||||
my $results = $anvil->Database->query({query => $query, source => $THIS_FILE, line => __LINE__}); |
||||
my $count = @{$results}; |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { |
||||
results => $results, |
||||
count => $count, |
||||
}}); |
||||
if (not $count) |
||||
{ |
||||
# No bad keys found on this host. |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 0, priority => "err", key => "error_0078"}); |
||||
sleep 10; |
||||
$anvil->nice_exit({exit_code => 2}); |
||||
} |
||||
my $progress = 0; |
||||
update_progress($anvil, 0, "clear"); |
||||
$progress += 5; |
||||
update_progress($anvil, $progress, "job_0048"); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 2, key => "job_0048"}); |
||||
foreach my $row (@{$results}) |
||||
{ |
||||
|
||||
my $state_uuid = $row->[0]; |
||||
my $state_name = $row->[1]; |
||||
my $state_note = $row->[2]; |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { |
||||
state_uuid => $state_uuid, |
||||
state_name => $state_name, |
||||
state_note => $state_note, |
||||
}}); |
||||
|
||||
# Pull out the details. |
||||
my $bad_file = ""; |
||||
my $bad_line = ""; |
||||
foreach my $pair (split/,/, $state_note) |
||||
{ |
||||
my ($variable, $value) = ($pair =~ /^(.*?)=(.*)$/); |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { |
||||
pair => $pair, |
||||
variable => $variable, |
||||
value => $value, |
||||
}}); |
||||
if ($variable eq "file") |
||||
{ |
||||
$bad_file = $value; |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { bad_file => $bad_file }}); |
||||
} |
||||
if ($variable eq "line") |
||||
{ |
||||
$bad_line = $value; |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { bad_line => $bad_line }}); |
||||
} |
||||
} |
||||
my ($target, $user) = ($state_name =~ /host_key_changed::(.*)::(.*)$/); |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { |
||||
target => $target, |
||||
user => $user, |
||||
bad_file => $bad_file, |
||||
bad_line => $bad_line, |
||||
}}); |
||||
|
||||
$progress += 5; $progress = 95 if $progress > 95; |
||||
update_progress($anvil, $progress, "job_0049,!!line!:".$bad_line.",!!file!".$bad_file."!!,!!target!".$target."!!"); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 2, key => "job_0049", variables => { |
||||
line => $bad_line, |
||||
file => $bad_file, |
||||
target => $target, |
||||
}}); |
||||
|
||||
# Read in the file, if it exists. |
||||
if (not -e $bad_file) |
||||
{ |
||||
$progress += 10; $progress = 95 if $progress > 95; |
||||
update_progress($anvil, $progress, "job_0050,!!file!".$bad_file."!!"); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 2, key => "job_0050", variables => { file => $bad_file }}); |
||||
|
||||
# Remove this job and go on to the next bad key (if any). |
||||
delete_state($anvil, $state_uuid); |
||||
next; |
||||
} |
||||
|
||||
# Read in the file |
||||
my ($old_body) = $anvil->Storage->read_file({file => $bad_file}); |
||||
if ($old_body eq "!!error!!") |
||||
{ |
||||
# Failed to read the file |
||||
$progress += 10; $progress = 95 if $progress > 95; |
||||
update_progress($anvil, $progress, "job_0052,!!file!".$bad_file."!!"); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 2, key => "job_0052", variables => { file => $bad_file }}); |
||||
|
||||
# Remove this job and go on to the next bad key (if any). |
||||
delete_state($anvil, $state_uuid); |
||||
next; |
||||
} |
||||
|
||||
# Find our key |
||||
my $line_number = 0; |
||||
my $new_body = ""; |
||||
my $update = 0; |
||||
foreach my $line (split/\n/, $old_body) |
||||
{ |
||||
$line_number++; |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { |
||||
's1:line_number' => $line_number, |
||||
's2:bad_line' => $bad_line, |
||||
's3:line' => $line, |
||||
}}); |
||||
if ($line_number eq $bad_line) |
||||
{ |
||||
# Verify that this is, indeed, the right line. |
||||
if ($line =~ /^$target /) |
||||
{ |
||||
# Found it! |
||||
$progress += 5; $progress = 95 if $progress > 95; |
||||
update_progress($anvil, $progress, "job_0053"); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 2, key => "job_0053"}); |
||||
$update = 1; |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { update => $update }}); |
||||
last; |
||||
} |
||||
else |
||||
{ |
||||
# Line found, but not for the target. |
||||
$progress += 10; $progress = 95 if $progress > 95; |
||||
update_progress($anvil, $progress, "job_0054,!!line!".$bad_line."!!,!!file!".$bad_file."!!,!!target!".$target."!!"); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 2, key => "job_0054", variables => { |
||||
line => $bad_line, |
||||
file => $bad_file, |
||||
target => $target, |
||||
}}); |
||||
|
||||
# Remove this job and go on to the next bad key (if any). |
||||
delete_state($anvil, $state_uuid); |
||||
last; |
||||
} |
||||
} |
||||
else |
||||
{ |
||||
$new_body .= $line."\n"; |
||||
} |
||||
} |
||||
|
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 2, list => { |
||||
's1:old_body' => $old_body', |
||||
's2:new_body' => $new_body, |
||||
's3:update' => $update, |
||||
}}); |
||||
if ($update) |
||||
{ |
||||
# Write the file out. |
||||
$progress += 5; $progress = 95 if $progress > 95; |
||||
update_progress($anvil, $progress, "job_0055,!!file!".$bad_file."!!"); |
||||
$anvil->Log->entry({source => $THIS_FILE, line => __LINE__, 'print' => 1, level => 2, key => "job_0055", variables => { file => $bad_file }}); |
||||
} |
||||
|
||||
} |
||||
|
||||
# Done. |
||||
update_progress($anvil, 100, "job_0051"); |
||||
$anvil->nice_exit({code => 0}); |
||||
|
||||
|
||||
############################################################################################################# |
||||
# Functions # |
||||
############################################################################################################# |
||||
|
||||
# This deletes a state entry. |
||||
sub delete_state |
||||
{ |
||||
my ($anvil, $state_uuid) = @_; |
||||
|
||||
# Delete it so long as we have a UUID. |
||||
if ($state_uuid) |
||||
{ |
||||
my $query = "DELETE FROM states WHERE state_uuid = ".$anvil->Database->quote($state_uuid).";"; |
||||
$anvil->Database->write({debug => 2, query => $merged, source => $THIS_FILE, line => __LINE__}); |
||||
} |
||||
|
||||
return(0); |
||||
} |
||||
|
||||
# This updates the progress if we were called with a job UUID. |
||||
sub update_progress |
||||
{ |
||||
my ($anvil, $progress, $message) = @_; |
||||
|
||||
# Log the progress percentage. |
||||
$anvil->Log->variables({source => $THIS_FILE, line => __LINE__, level => 3, list => { |
||||
progress => $progress, |
||||
message => $message, |
||||
"jobs::job_uuid" => $anvil->data->{jobs}{job_uuid}, |
||||
}}); |
||||
|
||||
if ($anvil->data->{jobs}{job_uuid}) |
||||
{ |
||||
$anvil->Job->update_progress({ |
||||
debug => 3, |
||||
progress => $progress, |
||||
message => $message, |
||||
job_uuid => $anvil->data->{jobs}{job_uuid}, |
||||
}); |
||||
} |
||||
|
||||
return(0); |
||||
} |
||||
Loading…
Reference in new issue