Ñò
ìÿÒXc @ sô d d k l Z l Z d d k l Z l Z l Z l Z l Z l Z d d k Td d k l
Z
l Z e
d ƒ Z d e
d ƒ f Z
d „ Z d „ Z d
e f d „ ƒ YZ e i e ƒ d e f d
„ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ d e f d „ ƒ YZ! d e" f d „ ƒ YZ# e i e# ƒ d e$ f d! „ ƒ YZ% e i e% ƒ d" e" f d# „ ƒ YZ& e i e& ƒ d$ e$ f d% „ ƒ YZ' e i e' ƒ d& e" f d' „ ƒ YZ( e i e( ƒ d( e$ f d) „ ƒ YZ) e i e) ƒ d* e" f d+ „ ƒ YZ* e i e* ƒ d, e$ f d- „ ƒ YZ+ e i e+ ƒ d. S(/ iÿÿÿÿ( t apit errors( t
AccessTimet Passwordt Strt StrEnumt Boolt DeprecatedParam( t *( t _t ngettexts
Host-based access control
Control who can access what services on what hosts. You
can use HBAC to control which users or groups can
access a service, or group of services, on a target host.
You can also specify a category of users and target hosts.
This is currently limited to "all", but might be expanded in the
future.
Target hosts in HBAC rules must be hosts managed by IPA.
The available services and groups of services are controlled by the
hbacsvc and hbacsvcgroup plug-ins respectively.
EXAMPLES:
Create a rule, "test1", that grants all users access to the host "server" from
anywhere:
ipa hbacrule-add --usercat=all test1
ipa hbacrule-add-host --hosts=server.example.com test1
Display the properties of a named HBAC rule:
ipa hbacrule-show test1
Create a rule for a specific service. This lets the user john access
the sshd service on any machine from any machine:
ipa hbacrule-add --hostcat=all john_sshd
ipa hbacrule-add-user --users=john john_sshd
ipa hbacrule-add-service --hbacsvcs=sshd john_sshd
Create a rule for a new service group. This lets the user john access
the FTP service on any machine from any machine:
ipa hbacsvcgroup-add ftpers
ipa hbacsvc-add sftp
ipa hbacsvcgroup-add-member --hbacsvcs=ftp,sftp ftpers
ipa hbacrule-add --hostcat=all john_ftp
ipa hbacrule-add-user --users=john john_ftp
ipa hbacrule-add-service --hbacsvcgroups=ftpers john_ftp
Disable a named HBAC rule:
ipa hbacrule-disable test1
Remove a named HBAC rule:
ipa hbacrule-del allow_server
t hbacs" Host-based access control commandsc C s9 | i ƒ d j o" t i d d d t d ƒ ƒ ‚ n d S( Nt denyt namet typet errors" The deny type has been deprecated.( t lowerR t ValidationErrorR ( t ugettextR ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyt
validate_type[ s c C s | | j ol | | d j o[ t | | ƒ t t f j o | | d i ƒ } n | | i ƒ } | d j o t Sn t Sd S( sF
See if options[attribute] is lower-case 'all' in a safe way.
i t allN( t NoneR t listt tupleR t Truet False( t optionst attributet value( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyt is_all_ s
t hbacrulec B s÷ e Z d Z e i i Z e d ƒ Z e d ƒ Z d d g Z
d d d d d d
d d d d
d d d d g Z d Z d Z
h d d g d 6d d g d 6d d g d
6d d g d 6Z e d ƒ Z e d ƒ Z e d d d d e d ƒ d e ƒe d e d d! d" e d# ƒ d e d$ ƒ d% dS d( d& d) e d* d+ d, d- d. g ƒe d/ d d0 d e d1 ƒ d" e d2 ƒ d% dT ƒe d4 d d5 d e d6 ƒ d" e d7 ƒ d% dU ƒe d8 ƒ e d9 d d: d e d; ƒ d" e d< ƒ d% dV ƒe d= d d> d e d? ƒ ƒe d@ d e dA ƒ d, d- g ƒe dB d e dC ƒ d, dD dE dF g ƒe dG d e dH ƒ d, dD dE dF g ƒe dI d e dJ ƒ d, dD dE dF g ƒe dK d e dL ƒ d, dD dE dF g ƒe dM ƒ e dN ƒ e dO d e dP ƒ d, dD dE dF g ƒe dQ d e dR ƒ d, dD dE dF g ƒe f Z RS(W s
HBAC object.
s HBAC rules
HBAC rulest ipaassociationt ipahbacrulet cnt ipaenabledflagt descriptiont usercategoryt hostcategoryt sourcehostcategoryt servicecategoryt
memberusert
sourcehostt
memberhostt
memberservicet memberhostgroupt externalhostt ipauniqueidt usert groupt hostt hostgroupt hbacsvct hbacsvcgroups
HBAC Ruless HBAC Rulet cli_nameR
t labels Rule namet primary_keyt accessruletypeR t docs Rule type (allow)s Rule typet valuesu allowu denyt defaultt autofillt excludet webuit flagst no_optiont no_outputs
usercategory?t usercats
User categorys! User category the rule applies tou alls
hostcategory?t hostcats
Host categorys! Host category the rule applies tos sourcehostcategory?s servicecategory?t
servicecats Service categorys$ Service category the rule applies tos description?t desct Descriptions ipaenabledflag?t Enableds memberuser_user?t Userst no_createt no_updatet no_searchs memberuser_group?s User Groupss memberhost_host?t Hostss memberhost_hostgroup?s Host Groupss sourcehost_host?s sourcehost_hostgroup?s memberservice_hbacsvc?t Servicess memberservice_hbacsvcgroup?s Service Groups( u allowu deny( u all( u all( u all( t __name__t
__module__t __doc__R t envt container_hbact container_dnR t object_namet object_name_pluralt object_classt default_attributest uuid_attributet
rdn_attributet attribute_membersR6 t label_singularR R R R R R t external_host_paramt takes_params( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR n s–
t hbacrule_addc B s) e Z e d ƒ Z e d ƒ Z d „ Z RS( s Create a new HBAC rule.s Added HBAC rule "%(value)s"c O s d | d <| S( Nt TRUER" ( ( t selft ldapt dnt entry_attrst
attrs_listt keysR ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyt pre_callbackÞ s
( RN RO R RP t msg_summaryRf ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR^ Ù s t hbacrule_delc B s) e Z e d ƒ Z e d ƒ Z d „ Z RS( s Delete an HBAC rule.s Deleted HBAC rule "%(value)s"c O sz t d | d ƒ } t i i d | } | d oC t i d | d d | i i d i d | d d d d ƒ ‚ n | S(
Nt seealsoi t countt keyR6 t selinuxusermapt dependentt resultR! ( t dictR t Commandt selinuxusermap_findR R t DependentEntryt ObjectR[ ( R` Ra Rb Re R t kwt _entries( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRf ì s
C( RN RO R RP Rg Rf ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRh ç s t hbacrule_modc B s) e Z e d ƒ Z e d ƒ Z d „ Z RS( s Modify an HBAC rule.s Modified HBAC rule "%(value)s"c O sô y | i | | ƒ \ } } Wn& t i j
o | i i | Œ n Xt | d ƒ o) d | j o t i d t d ƒ ƒ ‚ n t | d ƒ o) d | j o t i d t d ƒ ƒ ‚ n t | d ƒ o) d | j o t i d t d
ƒ ƒ ‚ n | S( NR$ R( t reasonsB user category cannot be set to 'all' while there are allowed usersR% R* sB host category cannot be set to 'all' while there are allowed hostsR' R+ sH service category cannot be set to 'all' while there are allowed services( t get_entryR t NotFoundt objt handle_not_foundR t MutuallyExclusiveErrorR ( R` Ra Rb Rc Rd Re R ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRf ý s ( RN RO R RP Rg Rf ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRv ø s t
hbacrule_findc B s& e Z e d ƒ Z e d d d ƒ Z RS( s Search for HBAC rules.s %(count)d HBAC rule matcheds %(count)d HBAC rules matchedi ( RN RO R RP R
Rg ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR} s t
hbacrule_showc B s e Z e d ƒ Z RS( s' Display the properties of an HBAC rule.( RN RO R RP ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR~ s t hbacrule_enablec B s2 e Z e d ƒ Z e d ƒ Z e i Z d „ Z RS( s Enable an HBAC rule.s Enabled HBAC rule "%(value)s"c C s | i i } | i i | ƒ } h d d 6} y | i | | ƒ Wn; t i j
o n' t i j
o | i i | ƒ n Xt d t d | ƒ S( NR_ R" Rn R (
Rz t backendt get_dnt update_entryR t EmptyModlistRy R{ Ro R ( R` R! Ra Rb Rc ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyt execute% s
( RN RO R RP Rg t outputt standard_valuet
has_outputR„ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR s t hbacrule_disablec B s2 e Z e d ƒ Z e d ƒ Z e i Z d „ Z RS( s Disable an HBAC rule.s Disabled HBAC rule "%(value)s"c C s | i i } | i i | ƒ } h d d 6} y | i | | ƒ Wn; t i j
o n' t i j
o | i i | ƒ n Xt d t d | ƒ S( Nt FALSER" Rn R (
Rz R€ R R‚ R Rƒ Ry R{ Ro R ( R` R! Ra Rb Rc ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR„ @ s
( RN RO R RP Rg R… R† R‡ R„ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRˆ : s t hbacrule_add_accesstimec B sA e Z d Z e d d d d e d ƒ ƒf Z d „ Z d „ Z RS( s-
Add an access time to an HBAC rule.
t
accesstimeR5 t timeR6 s Access timec K sµ | i i } | i i | ƒ } | i | d g ƒ \ } } | i d g ƒ i | d ƒ y | i | | ƒ Wn; t i j
o n' t i j
o | i i
| ƒ n Xt d t ƒ S( NR‹ Rn (
Rz R€ R Rx t
setdefaultt appendR‚ R Rƒ Ry R{ Ro R ( R` R! R Ra Rb Rc ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR„ a s c K s/ | i | i ƒ | i d | d | f ƒ d S( Ns( Added access time "%s" to HBAC rule "%s"R‹ ( t
print_nameR
t print_dashed( R` t textuiRn R! R ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyt output_for_clis s ( RN RO RP R R t
takes_optionsR„ R’ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRŠ U s t hbacrule_remove_accesstimec B sA e Z d Z e d d d d e d ƒ ƒf Z d „ Z d „ Z RS( s*
Remove access time to HBAC rule.
s accesstime?R5 RŒ R6 s Access timec K s» | i i } | i i | ƒ } | i | d g ƒ \ } } y1 | i d g ƒ i | d ƒ | i | | ƒ WnA t t i f j
o n' t i
j
o | i i | ƒ n Xt d t
ƒ S( NR‹ Rn ( Rz R€ R Rx R t removeR‚ t
ValueErrorR Rƒ Ry R{ Ro R ( R` R! R Ra Rb Rc ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR„ ‰ s c K s/ | i | i ƒ | i d | d | f ƒ d S( Ns, Removed access time "%s" from HBAC rule "%s"R‹ ( R R
R ( R` R‘ Rn R! R ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR’ › s ( RN RO RP R R R“ R„ R’ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR” ~ s t hbacrule_add_userc B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s% Add users and groups to an HBAC rule.R( s %i object added.s %i objects added.c O s“ y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xd | j o7 | d d i ƒ d j o t i d t d ƒ ƒ ‚ n | S( NR$ i R Rw s. users cannot be added when user category='all'( Rx Rz RW R Ry R{ R R| R ( R` Ra Rb t foundt not_foundRe R Rc ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRf ¬ s "
( s %i object added.s %i objects added.( RN RO R RP t member_attributest member_count_outRf ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR— ¦ s t hbacrule_remove_userc B s# e Z e d ƒ Z d g Z d Z RS( s* Remove users and groups from an HBAC rule.R( s %i object removed.s %i objects removed.( s %i object removed.s %i objects removed.( RN RO R RP Rš R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRœ » s t hbacrule_add_hostc B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s0 Add target hosts and hostgroups to an HBAC rule.R* s %i object added.s %i objects added.c O s“ y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xd | j o7 | d d i ƒ d j o t i d t d ƒ ƒ ‚ n | S( NR% i R Rw s. hosts cannot be added when host category='all'( Rx Rz RW R Ry R{ R R| R ( R` Ra Rb R˜ R™ Re R Rc ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRf Ê s "
( s %i object added.s %i objects added.( RN RO R RP Rš R› Rf ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR Ä s t hbacrule_remove_hostc B s# e Z e d ƒ Z d g Z d Z RS( s5 Remove target hosts and hostgroups from an HBAC rule.R* s %i object removed.s %i objects removed.( s %i object removed.s %i objects removed.( RN RO R RP Rš R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRž Ù s t hbacrule_add_sourcehostc B s& e Z e Z d g Z d Z d „ Z RS( R) s %i object added.s %i objects added.c K s t i d d ƒ ‚ d S( NR
RŸ ( R t DeprecationError( R` Rt ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyt validateè s ( s %i object added.s %i objects added.( RN RO R t NO_CLIRš R› R¡ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRŸ â s t hbacrule_remove_sourcehostc B s& e Z e Z d g Z d Z d „ Z RS( R) s %i object removed.s %i objects removed.c K s t i d d ƒ ‚ d S( NR
R£ ( R R ( R` Rt ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR¡ ô s ( s %i object removed.s %i objects removed.( RN RO R R¢ Rš R› R¡ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR£ î s t hbacrule_add_servicec B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s Add services to an HBAC rule.R+ s %i object added.s %i objects added.c O s“ y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xd | j o7 | d d i ƒ d j o t i d t d ƒ ƒ ‚ n | S( NR' i R Rw s4 services cannot be added when service category='all'( Rx Rz RW R Ry R{ R R| R ( R` Ra Rb R˜ R™ Re R Rc ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyRf s "
( s %i object added.s %i objects added.( RN RO R RP Rš R› Rf ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR¤ ú s t hbacrule_remove_servicec B s# e Z e d ƒ Z d g Z d Z RS( s4 Remove service and service groups from an HBAC rule.R+ s %i object removed.s %i objects removed.( s %i object removed.s %i objects removed.( RN RO R RP Rš R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyR¥ s N(, t ipalibR R R R R R R R t ipalib.plugins.baseldapR R
RP t topicR R t
LDAPObjectR t registert
LDAPCreateR^ t
LDAPDeleteRh t
LDAPUpdateRv t
LDAPSearchR} t LDAPRetrieveR~ t LDAPQueryR Rˆ RŠ R” t
LDAPAddMemberR— t LDAPRemoveMemberRœ R Rž RŸ R£ R¤ R¥ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.pyt sT .
. h
)(