FM / config

/snap/core24/1643/usr/lib/python3/dist-packages/cloudinit/config/

/snap/core24/1643/usr/lib/python3/dist-packages/cloudinit/config

Name	Size	Mode	Actions
schemas/	-	0755	rm
__pycache__/	-	0755	rm
cc_ansible.py	10727	0644	edit dl rm
cc_apk_configure.py	4331	0644	edit dl rm
cc_apt_configure.py	39170	0644	edit dl rm
cc_apt_pipelining.py	1909	0644	edit dl rm
cc_bootcmd.py	1690	0644	edit dl rm
cc_byobu.py	2800	0644	edit dl rm
cc_ca_certs.py	9126	0644	edit dl rm
cc_chef.py	13502	0644	edit dl rm
cc_disable_ec2_metadata.py	1642	0644	edit dl rm
cc_disk_setup.py	52622	0644	edit dl rm
cc_fan.py	1997	0644	edit dl rm
cc_final_message.py	2561	0644	edit dl rm
cc_growpart.py	18809	0644	edit dl rm
cc_grub_dpkg.py	5524	0644	edit dl rm
cc_install_hotplug.py	3260	0644	edit dl rm
cc_keyboard.py	1527	0644	edit dl rm
cc_keys_to_console.py	2138	0644	edit dl rm
cc_landscape.py	3131	0644	edit dl rm
cc_locale.py	1211	0644	edit dl rm
cc_lxd.py	13798	0644	edit dl rm
cc_mcollective.py	4207	0644	edit dl rm
cc_mounts.py	19322	0644	edit dl rm
cc_ntp.py	19528	0644	edit dl rm
cc_package_update_upgrade_install.py	3909	0644	edit dl rm
cc_phone_home.py	3829	0644	edit dl rm
cc_power_state_change.py	6133	0644	edit dl rm
cc_puppet.py	10976	0644	edit dl rm
cc_raspberry_pi.py	6599	0644	edit dl rm
cc_reset_rmc.py	4432	0644	edit dl rm
cc_resizefs.py	10880	0644	edit dl rm
cc_resolv_conf.py	3206	0644	edit dl rm
cc_rh_subscription.py	16545	0644	edit dl rm
cc_rsyslog.py	11745	0644	edit dl rm
cc_runcmd.py	1640	0644	edit dl rm
cc_salt_minion.py	4053	0644	edit dl rm
cc_scripts_per_boot.py	1298	0644	edit dl rm
cc_scripts_per_instance.py	1295	0644	edit dl rm
cc_scripts_per_once.py	1271	0644	edit dl rm
cc_scripts_user.py	1282	0644	edit dl rm
cc_scripts_vendor.py	1292	0644	edit dl rm
cc_seed_random.py	3068	0644	edit dl rm
cc_set_hostname.py	3481	0644	edit dl rm
cc_set_passwords.py	10566	0644	edit dl rm
cc_snap.py	3436	0644	edit dl rm
cc_spacewalk.py	2708	0644	edit dl rm
cc_ssh.py	11224	0644	edit dl rm
cc_ssh_authkey_fingerprints.py	3850	0644	edit dl rm
cc_ssh_import_id.py	5571	0644	edit dl rm
cc_timezone.py	1157	0644	edit dl rm
cc_ubuntu_autoinstall.py	1304	0644	edit dl rm
cc_ubuntu_drivers.py	4174	0644	edit dl rm
cc_ubuntu_pro.py	13971	0644	edit dl rm
cc_update_etc_hosts.py	2522	0644	edit dl rm
cc_update_hostname.py	2230	0644	edit dl rm
cc_users_groups.py	2930	0644	edit dl rm
cc_wireguard.py	6825	0644	edit dl rm
cc_write_files.py	6296	0644	edit dl rm
cc_write_files_deferred.py	1308	0644	edit dl rm
cc_yum_add_repo.py	4641	0644	edit dl rm
cc_zypper_add_repo.py	5052	0644	edit dl rm
modules.py	13643	0644	edit dl rm
schema.py	52049	0644	edit dl rm
__init__.py	40	0644	edit dl rm

Edit: /snap/core24/1643/usr/lib/python3/dist-packages/cloudinit/config/cc_set_passwords.py (10566B)

# Copyright (C) 2009-2010 Canonical Ltd.
# Copyright (C) 2012, 2013 Hewlett-Packard Development Company, L.P.
#
# Author: Scott Moser <scott.moser@canonical.com>
# Author: Juerg Haefliger <juerg.haefliger@hp.com>
#
# This file is part of cloud-init. See LICENSE file for license information.
"""Set Passwords: Set user passwords and enable/disable SSH password auth"""

import logging
import random
import re
import string
from typing import List

from cloudinit import features, lifecycle, subp, util
from cloudinit.cloud import Cloud
from cloudinit.config import Config
from cloudinit.config.schema import MetaSchema
from cloudinit.distros import ALL_DISTROS, Distro, ug_util
from cloudinit.log import log_util
from cloudinit.settings import PER_INSTANCE
from cloudinit.ssh_util import update_ssh_config

meta: MetaSchema = {
    "id": "cc_set_passwords",
    "distros": [ALL_DISTROS],
    "frequency": PER_INSTANCE,
    "activate_by_schema_keys": [],
}

LOG = logging.getLogger(__name__)

def get_users_by_type(users_list: list, pw_type: str) -> list:
    """either password or type: RANDOM is required, user is always required"""
    return (
        []
        if not users_list
        else [
            (item["name"], item.get("password", "RANDOM"))
            for item in users_list
            if item.get("type", "hash") == pw_type
        ]
    )

def _restart_ssh_daemon(distro: Distro, service: str, *extra_args: str):
    try:
        distro.manage_service("restart", service, *extra_args)
        LOG.debug("Restarted the SSH daemon.")
    except subp.ProcessExecutionError as e:
        LOG.warning(
            "'ssh_pwauth' configuration may not be applied. Cloud-init was "
            "unable to restart SSH daemon due to error: '%s'",
            e,
        )

def handle_ssh_pwauth(pw_auth, distro: Distro):
    """Apply sshd PasswordAuthentication changes.

@param pw_auth: config setting from 'pw_auth'.
                    Best given as True, False, or "unchanged".
    @param distro: an instance of the distro class for the target distribution

@return: None"""
    service = distro.get_option("ssh_svcname", "ssh")

cfg_name = "PasswordAuthentication"

if isinstance(pw_auth, str):
        lifecycle.deprecate(
            deprecated="Using a string value for the 'ssh_pwauth' key",
            deprecated_version="22.2",
            extra_message="Use a boolean value with 'ssh_pwauth'.",
        )
    if util.is_true(pw_auth):
        cfg_val = "yes"
    elif util.is_false(pw_auth):
        cfg_val = "no"
    else:
        bmsg = f"Leaving SSH config '{cfg_name}' unchanged."
        if pw_auth is None or pw_auth.lower() == "unchanged":
            LOG.debug("%s ssh_pwauth=%s", bmsg, pw_auth)
        else:
            LOG.warning("%s Unrecognized value: ssh_pwauth=%s", bmsg, pw_auth)
        return

updated = update_ssh_config({cfg_name: cfg_val})
    if not updated:
        LOG.debug("No need to restart SSH service, %s not updated.", cfg_name)
        return

if distro.uses_systemd():
        state = subp.subp(
            [
                "systemctl",
                "show",
                "--property",
                "ActiveState",
                "--value",
                service,
            ]
        ).stdout.strip()
        if state.lower() in ["active", "activating", "reloading"]:
            # This module runs Before=sshd.service. What that means is that
            # the code can only get to this point if a user manually starts the
            # network stage. While this isn't a well-supported use-case, this
            # does cause a deadlock if started via systemd directly:
            # "systemctl start cloud-init.service". Prevent users from causing
            # this deadlock by forcing systemd to ignore dependencies when
            # restarting. Note that this deadlock is not possible in newer
            # versions of cloud-init, since starting the second service doesn't
            # run the second stage in 24.3+. This code therefore exists solely
            # for backwards compatibility so that users who think that they
            # need to manually start cloud-init (why?) with systemd (again,
            # why?) can do so.
            _restart_ssh_daemon(
                distro, service, "--job-mode=ignore-dependencies"
            )
    else:
        _restart_ssh_daemon(distro, service)

def handle(name: str, cfg: Config, cloud: Cloud, args: list) -> None:
    distro: Distro = cloud.distro
    if args:
        # if run from command line, and give args, wipe the chpasswd['list']
        password = args[0]
        if "chpasswd" in cfg and "list" in cfg["chpasswd"]:
            del cfg["chpasswd"]["list"]
    else:
        password = util.get_cfg_option_str(cfg, "password", None)

expire = True
    plist: List = []
    users_list: List = []

if "chpasswd" in cfg:
        chfg = cfg["chpasswd"]
        users_list = util.get_cfg_option_list(chfg, "users", default=[])
        if "list" in chfg and chfg["list"]:
            lifecycle.deprecate(
                deprecated="Config key 'lists'",
                deprecated_version="22.3",
                extra_message="Use 'users' instead.",
            )
            if isinstance(chfg["list"], list):
                LOG.debug("Handling input for chpasswd as list.")
                plist = util.get_cfg_option_list(chfg, "list", plist)
            else:
                lifecycle.deprecate(
                    deprecated="The chpasswd multiline string",
                    deprecated_version="22.2",
                    extra_message="Use string type instead.",
                )
                LOG.debug("Handling input for chpasswd as multiline string.")
                multiline = util.get_cfg_option_str(chfg, "list")
                if multiline:
                    plist = multiline.splitlines()

expire = util.get_cfg_option_bool(chfg, "expire", expire)

if not (users_list or plist) and password:
        (users, _groups) = ug_util.normalize_users_groups(cfg, distro)
        (user, _user_config) = ug_util.extract_default(users)
        if user:
            plist = ["%s:%s" % (user, password)]
        else:
            LOG.warning("No default or defined user to change password for.")

errors = []
    if plist or users_list:
        # This section is for parsing the data that arrives in the form of
        #   chpasswd:
        #     users:
        plist_in = get_users_by_type(users_list, "text")
        users = [user for user, _ in plist_in]
        hashed_plist_in = get_users_by_type(users_list, "hash")
        hashed_users = [user for user, _ in hashed_plist_in]
        randlist = []
        for user, _ in get_users_by_type(users_list, "RANDOM"):
            password = rand_user_password()
            users.append(user)
            plist_in.append((user, password))
            randlist.append(f"{user}:{password}")

# This for loop is for parsing the data that arrives in the deprecated
        # form of
        #   chpasswd:
        #     list:
        # N.B. This regex is included in the documentation (i.e. the schema
        # docstring), so any changes to it should be reflected there.
        prog = re.compile(r"\$(1|2a|2y|5|6)(\$.+){2}")
        for line in plist:
            u, p = line.split(":", 1)
            if prog.match(p) is not None and ":" not in p:
                hashed_plist_in.append((u, p))
                hashed_users.append(u)
            else:
                # in this else branch, we potentially change the password
                # hence, a deviation from .append(line)
                if p == "R" or p == "RANDOM":
                    p = rand_user_password()
                    randlist.append("%s:%s" % (u, p))
                plist_in.append((u, p))
                users.append(u)
        if users:
            try:
                LOG.debug("Changing password for %s:", users)
                distro.chpasswd(plist_in, hashed=False)
            except Exception as e:
                errors.append(e)
                util.logexc(
                    LOG, "Failed to set passwords with chpasswd for %s", users
                )

if hashed_users:
            try:
                LOG.debug("Setting hashed password for %s:", hashed_users)
                distro.chpasswd(hashed_plist_in, hashed=True)
            except Exception as e:
                errors.append(e)
                util.logexc(
                    LOG,
                    "Failed to set hashed passwords with chpasswd for %s",
                    hashed_users,
                )

if len(randlist):
            blurb = (
                "Set the following 'random' passwords\n",
                "\n".join(randlist),
            )
            log_util.multi_log(
                "%s\n%s\n" % blurb, stderr=False, fallback_to_stdout=False
            )

if expire:
            users_to_expire = users
            if features.EXPIRE_APPLIES_TO_HASHED_USERS:
                users_to_expire += hashed_users
            expired_users = []
            for u in users_to_expire:
                try:
                    distro.expire_passwd(u)
                    expired_users.append(u)
                except Exception as e:
                    errors.append(e)
                    util.logexc(LOG, "Failed to set 'expire' for %s", u)
            if expired_users:
                LOG.debug("Expired passwords for: %s users", expired_users)

handle_ssh_pwauth(cfg.get("ssh_pwauth"), distro)

if len(errors):
        LOG.debug("%s errors occurred, re-raising the last one", len(errors))
        raise errors[-1]

def rand_user_password(pwlen=20):
    if pwlen < 4:
        raise ValueError("Password length must be at least 4 characters.")

# There are often restrictions on the minimum number of character
    # classes required in a password, so ensure we at least one character
    # from each class.
    res_rand_list = [
        random.choice(string.digits),
        random.choice(string.ascii_lowercase),
        random.choice(string.ascii_uppercase),
        random.choice(string.punctuation),
    ]

res_rand_list.extend(
        list(
            util.rand_str(
                pwlen - len(res_rand_list),
                select_from=string.digits
                + string.ascii_lowercase
                + string.ascii_uppercase
                + string.punctuation,
            )
        )
    )
    random.shuffle(res_rand_list)
    return "".join(res_rand_list)

cmd: