
    d                         d dl Z d dlZ d dlmZmZ d dlmc mZ d dlmc mZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d	Zd
ZdZdZdZdZd Z G d de      Zy)    N)datetime	timedelta)	add_eventWALAEventOperation)ustr)
get_osutil)textutil)	CryptUtil)
AGENT_NAMECURRENT_VERSIONz%a, %d %b %Y %H:%M:%S %Zz%Y-%m-%dzTransportPrivate.pemJIT_Account      c                     t        |       S N)RemoteAccessHandler)protocols    A/usr/lib/python3/dist-packages/azurelinuxagent/ga/remoteaccess.pyget_remote_access_handlerr   )   s    x((    c                   @    e Zd Zd Zd Zd Zd Zed        Zd Z	d Z
y)	r   c                     t               | _        || _        t        t	        j
                               | _        d | _        d| _        y )NT)	r   _os_util	_protocolr
   confget_openssl_cmd
_cryptUtil_remote_access_check_existing_jit_users)selfr   s     r   __init__zRemoteAccessHandler.__init__.   s7    "!#D$8$8$:;")-&r   c                 f   	 | j                   j                  r:| j                  j                  j	                         | _        | j                          y y # t        $ rT}dj                  t        j                  |            }t        t        t        t        j                  d|       Y d }~y d }~ww xY w)Nz<Exception processing goal state for remote access users: {0}F)versionop
is_successmessage)r   jit_enabledr   clientget_remote_accessr   _handle_remote_access	Exceptionformatr	   format_exceptionr   r   r   r   RemoteAccessHandling)r    emsgs      r   runzRemoteAccessHandler.run5   s    	#}}((&*nn&;&;&M&M&O#**, )  	#QXXYaYrYrstYuvCj-+@@!&!	# #	#s   AA 	B0A
B++B0c                 `      j                   j                         }t         fd|D              S )Nc              3   R   K   | ]  }j                  |d          s|d      yw)   r   N)_is_jit_user).0ur    s     r   	<genexpr>z>RemoteAccessHandler._get_existing_jit_users.<locals>.<genexpr>E   s&     FAd.?.?!.E1Q4Fs   '
')r   	get_usersset)r    	all_userss   ` r   _get_existing_jit_usersz+RemoteAccessHandler._get_existing_jit_usersC   s&    MM++-	FFFFr   c           	         | j                   ct        j                  d       d| _        | j	                         }t        d | j                   j                  j                  D              }| j                   j                  j                  D ]  }	 |j                  }t        j                  |t              }t        j                         }|j                  |vr-||k  r(| j                  |j                  |j                  |       nN|j                  |v r@||kD  r;t        j                  d|j                         | j!                  |j                          |D ]  }	 ||vr| j!                  |        y | j                  rKt        j                  d       | j	                         }d}	|D ]  }	 | j!                  |        |	sd| _        y y y # t"        $ r5}t        j$                  d|j                  t'        |             Y d }~xd }~ww xY w# t"        $ r*}t        j$                  d|t'        |             Y d }~d }~ww xY w# t"        $ r,}t        j$                  d|t'        |             d}	Y d }~d }~ww xY w)	Nz-Processing remote access users in goal state.Tc              3   4   K   | ]  }|j                     y wr   )name)r6   r7   s     r   r8   z<RemoteAccessHandler._handle_remote_access.<locals>.<genexpr>N   s     "Wa166"Ws   z!Remote access user '{0}' expired.z/Error processing remote access user '{0}' - {1}z-Error removing remote access user '{0}' - {1}z)Looking for existing remote access users.F)r   loggerinfor   r<   r:   	user_listusers
expirationr   strptimeREMOTE_USR_EXPIRATION_FORMATutcnowr?   	_add_userencrypted_password_remove_userr+   errorr   )
r    existing_jit_usersgoal_state_usersaccraw_expirationaccount_expirationnowr/   userremove_user_errorss
             r   r*   z)RemoteAccessHandler._handle_remote_accessG   s>   *KKGH-1D*!%!=!=!?""W43F3F3P3P3V3V"WW**44:: gg%(^^N)1):):>Kg)h&"//+Cxx'99cDV>Vsxx1G1GI[\%77CBT<T$GR))#((3g + aa#33))$/	a --GH%)%A%A%C"%*". 2D2))$/2 *5:D2 * . ! gLL!RTWT\T\^bcd^effg ! aLL!PRVX\]^X_``a" % 2%TVZ\`ab\cd-1*2sI   CG	H
*I 		H*HH
	H= H88H= 	I5	"I00I5c                     | t         k(  S r   )REMOTE_ACCESS_ACCOUNT_COMMENT)comments    r   r5   z RemoteAccessHandler._is_jit_user{   s    777r   c                    d}	 |t        d      z   j                  t              }t        j                  d||       | j
                  j                  ||t               d}t        j                  d|       t        j                  j                  t        j                         t              }| j                  j                  ||      }| j
                  j!                  ||t        j"                         t        j$                                | j
                  j'                  |       y # t(        $ r |r| j+                  |        w xY w)NFr   )daysz8Adding remote access user '{0}' with expiration date {1}Tz*Adding remote access user '{0}' to sudoers)r   strftimeDATE_FORMATr@   rA   r   useraddrU   ospathjoinr   get_lib_dirTRANSPORT_PRIVATE_CERTr   decrypt_secretchpasswdget_password_cryptidget_password_crypt_salt_lenconf_sudoerr+   rJ   )r    usernamerI   rP   
user_addedexpiration_dateprv_keypwds           r   rH   zRemoteAccessHandler._add_user   s    
	1I14EEOOP[\OKKRT\^mnMM!!(O=Z[JKKDhOggll4#3#3#57MNG//001CWMCMM""8S$2K2K2MtOoOoOqrMM%%h/ 	!!(+	s   D!D& &Ec                 f    t        j                  d|       | j                  j                  |       y )Nz!Removing remote access user '{0}')r@   rA   r   del_account)r    rf   s     r   rJ   z RemoteAccessHandler._remove_user   s#    7B!!(+r   N)__name__
__module____qualname__r!   r1   r<   r*   staticmethodr5   rH   rJ    r   r   r   r   -   s6    .#G2;h 8 8&,r   r   ) r\   os.pathr   r   azurelinuxagent.common.confcommonr   azurelinuxagent.common.loggerr@   azurelinuxagent.common.eventr   r   azurelinuxagent.common.futurer   azurelinuxagent.common.osutilr   azurelinuxagent.common.utilsr	   &azurelinuxagent.common.utils.cryptutilr
   azurelinuxagent.common.versionr   r   rF   rZ   r`   rU   MAX_TRY_ATTEMPTFAILED_ATTEMPT_THROTTLEr   objectr   rq   r   r   <module>r      sc   ( 
  ( * * . . F . 4 1 < F9 /  -  )g,& g,r   