Przeglądaj źródła

Implementing password hashing for ircbouncer and mailserver inside password_hash filter plugin

Aleksandr Bogdanov 7 lat temu
rodzic
commit
f5a38fec63

+ 0
- 40
README.md Wyświetl plik

@@ -115,46 +115,6 @@ Ansible (the tool setting up your server) runs locally on your computer and send
115 115
 Modify the settings in the `group_vars/sovereign` folder to your liking. If you want to see how they’re used in context, just search for the corresponding string.
116 116
 All of the variables in `group_vars/sovereign` must be set for sovereign to function.
117 117
 
118
-Setting `password_hash` for your mail users is a bit tricky. You can generate one using [doveadm-pw](http://wiki2.dovecot.org/Tools/Doveadm/Pw).
119
-
120
-    # doveadm pw -p'YOUR_PASSWORD' -s SHA512-CRYPT | sed -e 's/{.*}//'
121
-    $6$drlIN9fx7Aj7/iLu$XvjeuQh5tlzNpNfs4NwxN7.HGRLglTKism0hxs2C1OvD02d3x8OBN9KQTueTr53nTJwVShtCYiW80SGXAjSyM0
122
-
123
-`sed` is used here to truncate the hash type from the beginning of the `doveadm pw` output.
124
-
125
-Alternatively, if you don’t already have `doveadm` installed, Python 3.3 or higher on Linux will generate the appropriate string for you (assuming your password is `password`):
126
-
127
-    python3 -c 'import crypt; print(crypt.crypt("password", salt=crypt.METHOD_SHA512))'
128
-
129
-On OS X and other platforms the [passlib](https://pythonhosted.org/passlib/) package may be used to generate the required string:
130
-
131
-    python -c 'import passlib.hash; print(passlib.hash.sha512_crypt.encrypt("password", rounds=5000))'
132
-
133
-Same for the IRC password hash…
134
-
135
-    # znc --makepass
136
-    [ ** ] Type your new password.
137
-    [ ?? ] Enter Password: foo
138
-    [ ?? ] Confirm Password: foo
139
-    [ ** ] Kill ZNC process, if it's running.
140
-    [ ** ] Then replace password in the <User> section of your config with this:
141
-    <Pass password>
142
-            Method = sha256
143
-            Hash = 310c5f99825e80d5b1d663a0a993b8701255f16b2f6056f335ba6e3e720e57ed
144
-            Salt = YdlPM5yjBmc/;JO6cfL5
145
-    </Pass>
146
-    [ ** ] After that start ZNC again, and you should be able to login with the new password.
147
-
148
-Take the strings after `Hash =` and `Salt =` and insert them as the value for `irc_password_hash` and `irc_password_salt` respectively.
149
-
150
-Alternatively, if you don’t already have `znc` installed, Python 3.3 or higher on Linux will generate the appropriate string for you (assuming your password is `password`):
151
-
152
-    python3 -c 'import crypt; print("irc_password_salt: {}\nirc_password_hash: {}".format(*crypt.crypt("password", salt=crypt.METHOD_SHA256).split("$")[2:]))'
153
-
154
-On OS X and other platforms the passlib:https://pythonhosted.org/passlib/ package may be used to generate the required string:
155
-
156
-    python -c 'import passlib.hash; print("irc_password_salt: {}\nirc_password_hash: {}".format(*passlib.hash.sha256_crypt.encrypt("password", rounds=5000).split("$")[2:]))'
157
-
158 118
 For Git hosting, copy your public key into place:
159 119
 
160 120
 	cp ~/.ssh/id_rsa.pub roles/git/files/gitolite.pub

+ 41
- 0
filter_plugins/password_hash.py Wyświetl plik

@@ -0,0 +1,41 @@
1
+from ansible.errors import AnsibleError, AnsibleUndefinedVariable
2
+from jinja2 import StrictUndefined
3
+__metaclass__ = type
4
+
5
+
6
+try:
7
+    import passlib.hash
8
+    HAS_LIB = True
9
+except ImportError:
10
+    HAS_LIB = False
11
+
12
+
13
+def check_lib():
14
+    if not HAS_LIB:
15
+        raise AnsibleError('You need to install "passlib" prior to running '
16
+                           'password_hash-based filters')
17
+
18
+
19
+def doveadm_pw_hash(password):
20
+    check_lib()
21
+    if type(password) is StrictUndefined:
22
+        raise AnsibleUndefinedVariable('Please pass a string into this password_hash-based filter')
23
+    return passlib.hash.sha512_crypt.encrypt(password, rounds=5000)
24
+
25
+
26
+def znc_pw_salt(password):
27
+    return doveadm_pw_hash(password).split("$")[0]
28
+
29
+
30
+def znc_pw_hash(password):
31
+    return doveadm_pw_hash(password).split("$")[1]
32
+
33
+
34
+class FilterModule(object):
35
+
36
+    def filters(self):
37
+        return {
38
+            'doveadm_pw_hash': doveadm_pw_hash,
39
+            'znc_pw_salt': znc_pw_salt,
40
+            'znc_pw_hash': znc_pw_hash,
41
+        }

+ 2
- 3
group_vars/sovereign Wyświetl plik

@@ -18,7 +18,7 @@ mail_virtual_domains:
18 18
 mail_virtual_users:
19 19
   - account: "{{ main_user_name }}"
20 20
     domain: "{{ domain }}"
21
-    password_hash: TODO
21
+    password: TODO
22 22
     domain_pk_id: 1
23 23
 mail_virtual_aliases:
24 24
   - source: "root@{{ domain }}"
@@ -43,8 +43,7 @@ irc_nick: (required)
43 43
 irc_ident: (required)
44 44
 irc_realname: (required)
45 45
 irc_quitmsg: (required)
46
-irc_password_hash: (required)
47
-irc_password_salt: (required)
46
+irc_password: TODO
48 47
 
49 48
 # xmpp
50 49
 prosody_admin: "{{ admin_email }}"

+ 2
- 3
group_vars/testing Wyświetl plik

@@ -24,7 +24,7 @@ mail_virtual_domains:
24 24
 mail_virtual_users:
25 25
   - account: "{{ main_user_name }}"
26 26
     domain: "{{ domain }}"
27
-    password_hash: "$6$IYJfaF3jvmbAzlSe$1HBkbIdrOTWA31WYon7VSE2xAcFzYSZuVb8d3I0NDWzPxXBaqkHqKs4rLeNO9CVQEKv7wA15QctCyXbdRqFDy." #foo
27
+    password: "foo"
28 28
     domain_pk_id: 1
29 29
 mail_virtual_aliases:
30 30
   - source: "root@{{ domain }}"
@@ -46,8 +46,7 @@ irc_nick: sovereign
46 46
 irc_ident: sovereign
47 47
 irc_realname: Mr. Sovereign
48 48
 irc_quitmsg: Bye
49
-irc_password_hash: "310c5f99825e80d5b1d663a0a993b8701255f16b2f6056f335ba6e3e720e57ed" #foo
50
-irc_password_salt: "YdlPM5yjBmc/;JO6cfL5"
49
+irc_password: "foo"
51 50
 irc_timezone: "America/New_York" #Example: "America/New_York"
52 51
 
53 52
 # xmpp

+ 1
- 0
requirements.txt Wyświetl plik

@@ -1 +1,2 @@
1 1
 ansible>=1.9.3,<2
2
+passlib

+ 2
- 2
roles/ircbouncer/templates/usr_lib_znc_configs_znc.conf.j2 Wyświetl plik

@@ -67,8 +67,8 @@ Version = 1.0
67 67
 
68 68
 	<Pass password>
69 69
 	        Method = sha256
70
-	        Hash = {{ irc_password_hash }}
71
-	        Salt = {{ irc_password_salt }}
70
+	        Hash = {{ irc_password | znc_pw_hash }}
71
+	        Salt = {{ irc_password | znc_pw_salt }}
72 72
 	</Pass>
73 73
 
74 74
 	<Network freenode>

+ 1
- 1
roles/mailserver/templates/mailserver.sql.j2 Wyświetl plik

@@ -44,7 +44,7 @@ INSERT INTO "virtual_domains" ("id", "name")
44 44
 INSERT INTO "virtual_users"  ("domain_id", "password" , "email")
45 45
 	VALUES (
46 46
 		'{{ virtual_user.domain_pk_id }}',
47
-		'{{ virtual_user.password_hash }}',
47
+		'{{ virtual_user.password | doveadm_pw_hash }}',
48 48
 		'{{ virtual_user.account }}@{{ virtual_user.domain }}'
49 49
 	);
50 50
 {% endfor %}

Ładowanie…
Anuluj
Zapisz