Checkmk git commits October 2018

checkmk-commits@lists.checkmk.com

15 participants
308 discussions

agent_azure: Add piggyback option for VM info

by Moritz Kiemer

Module: check_mk Branch: master Commit: 80e15e05d1d147579e80fc5c5f8762fa72c42323 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=80e15e05d1d147… Author: Moritz Kiemer <mo(a)mathias-kettner.de> Date: Tue Oct 23 15:22:11 2018 +0200 agent_azure: Add piggyback option for VM info CMK-1028 Change-Id: I4243138e36b9e314e9a5de3c1fa5f3c3deaef8fc --- agents/special/agent_azure | 27 ++++++++++++++++++--------- cmk/gui/plugins/wato/datasource_programs.py | 14 +++++++++++++- 2 files changed, 31 insertions(+), 10 deletions(-) diff --git a/agents/special/agent_azure b/agents/special/agent_azure index 739f3b9..7675ef0 100755 --- a/agents/special/agent_azure +++ b/agents/special/agent_azure @@ -83,6 +83,12 @@ def parse_arguments(argv): type=int, help='''Timeout for process joining in seconds (default 10)''') + parser.add_argument( + "--piggyback-vms", + default="", + choices=["agenthost", "self", "all"], + help='''Additionally create VM piggyback data for the host running the agent, + the VM iteself, or both''') # REQUIRED parser.add_argument("--subscription-id", required=True, help="Azure subscription ID") @@ -319,13 +325,18 @@ class AzureComputeClient(object): super(AzureComputeClient, self).__init__() self._client = ComputeManagementClient(creds, subs) - def process(self, vm): + def process(self, vm, args): use_keys = ('statuses',) inst_view = self._client.virtual_machines.get( vm.info["group"], vm.info["name"], expand='instanceView').instance_view.as_dict() items = ((k, inst_view.get(k)) for k in use_keys) vm.info["specific_info"] = {k: v for k, v in items if v is not None} + if args.piggyback_vms in ("agenthost", "all"): + vm.piggytargets.append('') + if args.piggyback_vms in ("self", "all"): + vm.piggytargets.append(vm.info["name"]) + class IssueCollecter(list): # basically a list of strings, just fancy appending. @@ -343,16 +354,15 @@ class AzureClient(object): def __init__(self, args): super(AzureClient, self).__init__() - self.debug = args.debug + self.args = args self.remaining_reads = "unknown (no metrics fetched)" - self.subscription = args.subscription_id self._creds = ServicePrincipalCredentials( client_id=args.client_id, secret=args.secret, tenant=args.tenant_id) # azure-api-call - self._monitor_client = MonitorManagementClient(self._creds, self.subscription) + self._monitor_client = MonitorManagementClient(self._creds, self.args.subscription_id) # azure-api-call - self._resource_client = ResourceManagementClient(self._creds, self.subscription) + self._resource_client = ResourceManagementClient(self._creds, self.args.subscription_id) self.specific_clients = {} @@ -373,13 +383,13 @@ class AzureClient(object): for rtp in r_types: client_class = AzureClient.SPECIFIC_CLIENTS.get(rtp) if client_class is not None: - self.specific_clients[rtp] = client_class(self._creds, self.subscription) + self.specific_clients[rtp] = client_class(self._creds, self.args.subscription_id) def process_specific(self, resource): client = self.specific_clients.get(resource.info["type"]) if client is None: return - client.process(resource) + client.process(resource, self.args) def discover_resources(self): if self.resources_cache is None: @@ -485,7 +495,7 @@ class AzureClient(object): ] LOG.debug("fetched metrics: %s", metricnames) except ErrorResponseException as exc: - if self.debug: + if self.args.debug: raise exc err.append("exception", rid, exc.message) LOG.exception(exc) @@ -532,7 +542,6 @@ class Threads(object): atexit.register(self.terminate) def run(self, resources, client, config): - if self.sequential: self._run_sequential(resources, client, config) else: diff --git a/cmk/gui/plugins/wato/datasource_programs.py b/cmk/gui/plugins/wato/datasource_programs.py index ae3a4e5..4acd44f 100644 --- a/cmk/gui/plugins/wato/datasource_programs.py +++ b/cmk/gui/plugins/wato/datasource_programs.py @@ -1364,13 +1364,25 @@ register_rule('datasource_programs', )), ], )), + ("--piggyback-vms", DropdownChoice( + title = _("Create piggyback VM data"), + help = _("You can choose to <i>additionally</i> send data concerning VMs to" + " the host that is associated with the special agent, to a piggyback" + " host with name of the VM itself, or both. By default data is sent" + " to the corresponding resource group only."), + choices = [ + ("agenthost", _("Send data to agent host")), + ("self", _("Send data to the VM itself")), + ("all", _("Send data to both the agent host and the VM itself")), + ], + )), ("--sequential", Checkbox( title = _("Run in single thread"), help = _("Check this to avoid multiprocessing. " "Recommended for debugging purposes only."), )), ], - optional_keys = False, + optional_keys = ["--piggyback-vms"], ), match = 'first', )

5 years, 8 months

Need to accept md5_crypt hashes for compatibility

by Lars Michelsen

Module: check_mk Branch: master Commit: d2aa85f64a6888e462afc6511c5c6e18d6a13f72 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=d2aa85f64a6888… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Thu Oct 25 11:39:21 2018 +0200 Need to accept md5_crypt hashes for compatibility Change-Id: Ic83d1a9b1de8b1a9877f03221805210d5d270440 --- cmk/gui/plugins/userdb/htpasswd.py | 1 + tests/unit/cmk/gui/test_userdb_htpasswd_connector.py | 2 ++ 2 files changed, 3 insertions(+) diff --git a/cmk/gui/plugins/userdb/htpasswd.py b/cmk/gui/plugins/userdb/htpasswd.py index 4f2d46d..e9ab85c 100644 --- a/cmk/gui/plugins/userdb/htpasswd.py +++ b/cmk/gui/plugins/userdb/htpasswd.py @@ -41,6 +41,7 @@ from . import UserConnector, user_connector_registry crypt_context = CryptContext(schemes=[ "sha256_crypt", # Kept for compatibility with Check_MK < 1.6 + "md5_crypt", "apr_md5_crypt", "des_crypt", ]) diff --git a/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py b/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py index c43c907..8a494a1 100644 --- a/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py +++ b/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py @@ -14,6 +14,7 @@ def htpasswd_file(tmpdir): # Pre 1.6 hashing formats (see cmk.gui.plugins.userdb.htpasswd for more details) u"bärnd:$apr1$/FU.SwEZ$Ye0XG1Huf2j7Jws7KD.h2/\n" u"cmkadmin:NEr3kqi287FQc\n" + u"harry:$1$478020$ldQUQ3RIwRYk5wjKfsWPD.\n" # A disabled user u"locked:!NEr3kqi287FQc\n" # A >= 1.6 sha256 hashed password @@ -62,5 +63,6 @@ def test_user_connector_verify_password(htpasswd_file, monkeypatch): assert c.check_credentials(u"cmkadmin", u"cmk") == u"cmkadmin" assert c.check_credentials(u"bärnd", u"cmk") == u"bärnd" assert c.check_credentials(u"sha256user", u"cmk") == u"sha256user" + assert c.check_credentials(u"harry", u"cmk") == u"harry" assert c.check_credentials(u"dingeling", u"aaa") is None assert c.check_credentials(u"locked", u"locked") == False

5 years, 8 months

Detect Clang 7, too.

by Sven Panne

Module: check_mk Branch: master Commit: 3be223b3becb5f69a650b3e51f7c93ad5ce3c513 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=3be223b3becb5f… Author: Sven Panne <sp(a)mathias-kettner.de> Date: Thu Oct 25 09:07:26 2018 +0200 Detect Clang 7, too. Change-Id: Icbf20fb7919b5f69eecd36d64518b901b0e1eeb6 --- configure.ac | 4 ++-- omd/packages/boost/Makefile | 2 +- omd/packages/googletest/Makefile | 2 +- omd/packages/python/Makefile | 4 ++-- omd/packages/re2/Makefile | 2 +- standalone.make | 2 ++ 6 files changed, 9 insertions(+), 7 deletions(-) diff --git a/configure.ac b/configure.ac index 26faf37..b0d49a2 100644 --- a/configure.ac +++ b/configure.ac @@ -49,12 +49,12 @@ AS_IF([test "x$enable_rrd_is_thread_safe" != "xno"], [RRDLIB_TO_CHECK=rrd], [RRDLIB_TO_CHECK=rrd_th]) # Checks for programs. -AC_PROG_CC([gcc-8 gcc-7 clang-6.0 clang-5.0 gcc clang]) +AC_PROG_CC([gcc-8 clang-7 gcc-7 clang-6.0 clang-5.0 gcc clang]) AC_PROG_CC_C99([], []) if test "x$ac_cv_prog_cc_c99" = xno; then AC_MSG_ERROR([Need a C99-compliant C compiler]) fi -AC_PROG_CXX([g++-8 g++-7 clang++-6.0 clang++-5.0 g++ clang++]) +AC_PROG_CXX([g++-8 clang++-7 g++-7 clang++-6.0 clang++-5.0 g++ clang++]) AC_DEFINE_UNQUOTED([BUILD_CXX], ["`$CXX --version | head -n1`"], [C++ compiler]) AX_CXX_COMPILE_STDCXX([17], [noext], [mandatory]) AC_PROG_RANLIB diff --git a/omd/packages/boost/Makefile b/omd/packages/boost/Makefile index f886a21..e61d544 100644 --- a/omd/packages/boost/Makefile +++ b/omd/packages/boost/Makefile @@ -23,7 +23,7 @@ build: check-python tar xjf $(NAME)_$(VERSION).tar.bz2 # basically what part of AC_PROC_CXX does @CXX="" ; \ - for PROG in g++-8 g++-7 clang++-6.0 clang++-5.0 g++-6 clang++-4.0 g++-5 clang++-3.9 clang++-3.8 clang++-3.7 clang++-3.6 clang++-3.5 g++-4.9 g++ clang++; do \ + for PROG in g++-8 clang++-7 g++-7 clang++-6.0 clang++-5.0 g++-6 clang++-4.0 g++-5 clang++-3.9 clang++-3.8 clang++-3.7 clang++-3.6 clang++-3.5 g++-4.9 g++ clang++; do \ echo -n "checking for $$PROG... "; SAVED_IFS=$$IFS; IFS=: ; \ for DIR in $$PATH; do \ IFS=$$SAVED_IFS ; \ diff --git a/omd/packages/googletest/Makefile b/omd/packages/googletest/Makefile index 9dd85c8..5cdfcb5 100644 --- a/omd/packages/googletest/Makefile +++ b/omd/packages/googletest/Makefile @@ -37,7 +37,7 @@ $(DIR)/Makefile: $(DIR)/Makefile.in # #basically what part of AC_PROC_CXX does @CXX="" ; \ - for PROG in g++-8 g++-7 clang++-6.0 clang++-5.0 g++-6 clang++-4.0 g++-5 clang++-3.9 clang++-3.8 clang++-3.7 clang++-3.6 clang++-3.5 g++-4.9 g++ clang++; do \ + for PROG in g++-8 clang++-7 g++-7 clang++-6.0 clang++-5.0 g++-6 clang++-4.0 g++-5 clang++-3.9 clang++-3.8 clang++-3.7 clang++-3.6 clang++-3.5 g++-4.9 g++ clang++; do \ echo -n "checking for $$PROG... "; SAVED_IFS=$$IFS; IFS=: ; \ for DIR in $$PATH; do \ IFS=$$SAVED_IFS ; \ diff --git a/omd/packages/python/Makefile b/omd/packages/python/Makefile index b2fe9db..bf21075 100644 --- a/omd/packages/python/Makefile +++ b/omd/packages/python/Makefile @@ -51,7 +51,7 @@ sitecustomize.pyc: sitecustomize.py # The compiler detection code below is basically what part of AC_PROC_CXX does. bin/gcc: @CC="" ; \ - for PROG in gcc-8 gcc-7 clang-6.0 clang-5.0 gcc-6 clang-4.0 gcc-5 clang-3.9 clang-3.8 clang-3.7 clang-3.6 clang-3.5 gcc-4.9 gcc clang; do \ + for PROG in gcc-8 clang-7 gcc-7 clang-6.0 clang-5.0 gcc-6 clang-4.0 gcc-5 clang-3.9 clang-3.8 clang-3.7 clang-3.6 clang-3.5 gcc-4.9 gcc clang; do \ echo -n "checking for $$PROG... "; SAVED_IFS=$$IFS; IFS=: ; \ for DIR in $$PATH; do \ IFS=$$SAVED_IFS ; \ @@ -68,7 +68,7 @@ bin/gcc: bin/g++: @CXX="" ; \ - for PROG in g++-8 g++-7 clang++-6.0 clang++-5.0 g++-6 clang++-4.0 g++-5 clang++-3.9 clang++-3.8 clang++-3.7 clang++-3.6 clang++-3.5 g++-4.9 g++ clang++; do \ + for PROG in g++-8 clang++-7 g++-7 clang++-6.0 clang++-5.0 g++-6 clang++-4.0 g++-5 clang++-3.9 clang++-3.8 clang++-3.7 clang++-3.6 clang++-3.5 g++-4.9 g++ clang++; do \ echo -n "checking for $$PROG... "; SAVED_IFS=$$IFS; IFS=: ; \ for DIR in $$PATH; do \ IFS=$$SAVED_IFS ; \ diff --git a/omd/packages/re2/Makefile b/omd/packages/re2/Makefile index 47e457c..c8401a8 100644 --- a/omd/packages/re2/Makefile +++ b/omd/packages/re2/Makefile @@ -12,7 +12,7 @@ DIR = $(NAME)-$(VERSION) build: unpack # basically what part of AC_PROC_CXX does @CXX="" ; \ - for PROG in g++-8 g++-7 clang++-6.0 clang++-5.0 g++-6 clang++-4.0 g++-5 clang++-3.9 clang++-3.8 clang++-3.7 clang++-3.6 clang++-3.5 g++-4.9 g++ clang++; do \ + for PROG in g++-8 clang++-7 g++-7 clang++-6.0 clang++-5.0 g++-6 clang++-4.0 g++-5 clang++-3.9 clang++-3.8 clang++-3.7 clang++-3.6 clang++-3.5 g++-4.9 g++ clang++; do \ echo -n "checking for $$PROG... "; SAVED_IFS=$$IFS; IFS=: ; \ for DIR in $$PATH; do \ IFS=$$SAVED_IFS ; \ diff --git a/standalone.make b/standalone.make index 1a7771e..40ebd4c 100644 --- a/standalone.make +++ b/standalone.make @@ -25,6 +25,8 @@ # TODO(sp) We should really use autotools here... ifneq ($(shell which g++-8 2>/dev/null),) CXX := g++-8 -std=c++17 +else ifneq ($(shell which clang++-7 2>/dev/null),) + CXX := clang++-7 -std=c++17 else ifneq ($(shell which g++-7 2>/dev/null),) CXX := g++-7 -std=c++17 else ifneq ($(shell which clang++-6.0 2>/dev/null),)

5 years, 8 months

6849 FIX Analyze configuration: Fixed wrong results for liveproxyd and persistent connection tests

by Lars Michelsen

Module: check_mk Branch: master Commit: 167db3b67d9ac05a5cb361558f3786991b3698d3 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=167db3b67d9ac0… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Wed Oct 24 15:14:44 2018 +0200 6849 FIX Analyze configuration: Fixed wrong results for liveproxyd and persistent connection tests Previously all analyze configuration tests were executed locally on each site. In case of the liveproxyd tests and persistent connection tests this was wrong because the tests have to check the connection configuration for a specific site on the central site. Change-Id: I93949f039ef24a44533fb1834dba9184970be2b4 --- .werks/6849 | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.werks/6849 b/.werks/6849 new file mode 100644 index 0000000..08a6edd --- /dev/null +++ b/.werks/6849 @@ -0,0 +1,14 @@ +Title: Analyze configuration: Fixed wrong results for liveproxyd and persistent connection tests +Level: 1 +Component: wato +Class: fix +Compatible: compat +Edition: cre +State: unknown +Version: 1.6.0i1 +Date: 1540386842 + +Previously all analyze configuration tests were executed locally on each site. +In case of the liveproxyd tests and persistent connection tests this was wrong +because the tests have to check the connection configuration for a specific +site on the central site.

5 years, 8 months

Cleaned up wildcard imports

by Lars Michelsen

Module: check_mk Branch: master Commit: 0309b93dd03ffeea9279c1281d76005e6283be81 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=0309b93dd03ffe… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Wed Oct 24 19:22:45 2018 +0200 Cleaned up wildcard imports * Unabled unused-imports and unused-wildcard-import pylint check * A very small amount of wildcard imports is left. These are mostly needed for the old GUI plugin compatibility Change-Id: I5269eb19e4f0814d4bd577ad64127a0c09442f67 --- .pylintrc | 5 ---- agents/special/agent_netapp | 4 +-- agents/special/agent_siemens_plc | 5 ++-- cmk/defines.py | 19 ++++++++++++++ cmk/gui/availability.py | 19 ++++++++++++-- cmk/gui/backup.py | 17 ++++++++++++- cmk/gui/config.py | 6 ++--- cmk/gui/crash_reporting.py | 7 +++++- cmk/gui/dashboard.py | 11 +++++++-- cmk/gui/key_mgmt.py | 10 +++++++- cmk/gui/metrics.py | 1 - cmk/gui/notify.py | 11 ++++++++- cmk/gui/pagetypes.py | 8 +++++- cmk/gui/plugins/main_modules/__init__.py | 19 ++------------ cmk/gui/plugins/sidebar/shipped.py | 5 ++-- cmk/gui/plugins/userdb/ldap_connector.py | 20 ++++++++++++++- cmk/gui/plugins/userdb/user_attributes.py | 14 +++++++++-- cmk/gui/plugins/views/availability.py | 15 ++++++++++-- cmk/gui/plugins/views/inventory.py | 5 +++- cmk/gui/plugins/views/mkeventd.py | 4 +-- cmk/gui/plugins/wato/active_checks.py | 28 +++++++++++++++++++-- cmk/gui/plugins/wato/bi.py | 25 +++++++++++++++++-- cmk/gui/plugins/wato/check_mk_configuration.py | 33 ++++++++++++++++++++++--- cmk/gui/plugins/wato/check_parameters.py | 34 ++++++++++++++++++++++++-- cmk/gui/plugins/wato/datasource_programs.py | 22 ++++++++++++++++- cmk/gui/plugins/wato/globals_notification.py | 15 +++++++++--- cmk/gui/plugins/wato/inventory.py | 13 +++++++--- cmk/gui/plugins/wato/notifications.py | 20 +++++++++++++-- cmk/gui/plugins/wato/omd_configuration.py | 14 +++++++++-- cmk/gui/plugins/webapi/__init__.py | 8 ++---- cmk/gui/userdb.py | 2 +- cmk/gui/valuespec.py | 10 ++------ cmk/gui/views.py | 16 ++++++++++-- cmk/gui/visuals.py | 15 +++++++++++- cmk/gui/wato/__init__.py | 2 +- cmk/gui/wato/mkeventd.py | 31 ++++++++++++++++++++++- cmk/gui/watolib.py | 30 ++++++++++++++++++++++- cmk/gui/webapi.py | 8 +++--- cmk/gui/werks.py | 12 ++++++++- cmk_base/config.py | 2 +- cmk_base/default_config/__init__.py | 3 +++ 41 files changed, 451 insertions(+), 97 deletions(-) Diff: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=0309b93dd0…

5 years, 8 months

6846 SEC More secure password hashing

by Lars Michelsen

Module: check_mk Branch: master Commit: a289dff1a63265a7d751741580647d22937ae5a7 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=a289dff1a63265… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Wed Oct 24 10:10:33 2018 +0200 6846 SEC More secure password hashing Passwords of local users of the Check_MK GUI are now hashed using SHA256 (salted, 535000 rounds) to increase the security of the stored user logon passwords. All existing users will still be able to login using their already hashed passwords. Once a user changes his password or a new user is created, these will be hashed using the new algorithm. Why SHA256? Check_MK supports different authentication frontends for verifying the local credentials: a) basic authentication (done by apache) and b) the GUI form + cookie based authentication. The default is b). This option is toggled with the "omd config" option MULTISITE_COOKIE_AUTH. In case the basic authentication is chosen it is only possible to use hashing algorithms that are supported by apache which performs the authentication in this situation. For best compatibility in all mentioned situations we use the SHA256 scheme. CMK-1151 Change-Id: I3e8ea4bdfe813e5d290ef94406340b89c73bfc9a --- .werks/6846 | 27 ++++++ cmk/gui/md5crypt.py | 99 ---------------------- cmk/gui/plugins/userdb/htpasswd.py | 83 ++++++++++++------ omd/packages/omd/omd | 88 +------------------ .../unit/cmk/gui/test_userdb_htpasswd_connector.py | 28 +++++- 5 files changed, 111 insertions(+), 214 deletions(-) Diff: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=a289dff1a6…

5 years, 8 months

Renamed encrypt_password() to hash_password()

by Lars Michelsen

Module: check_mk Branch: master Commit: d2aa46ddfb9304c2a68aa5d73eed93fcbb94443b URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=d2aa46ddfb9304… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Wed Oct 24 15:24:58 2018 +0200 Renamed encrypt_password() to hash_password() Change-Id: Icdab894dc9cbb2b1e26d3bd1f7b9c4a3de69767b --- cmk/gui/plugins/userdb/htpasswd.py | 2 +- cmk/gui/plugins/webapi/webapi.py | 6 +++--- cmk/gui/userdb.py | 2 +- cmk/gui/wato/__init__.py | 1 - cmk/gui/wato/pages/users.py | 6 +++--- cmk/gui/wato/user_profile.py | 4 ++-- omd/packages/omd/omd | 4 ++-- tests/unit/cmk/gui/test_userdb_htpasswd_connector.py | 6 +++--- 8 files changed, 15 insertions(+), 16 deletions(-) diff --git a/cmk/gui/plugins/userdb/htpasswd.py b/cmk/gui/plugins/userdb/htpasswd.py index aa07889..4f2d46d 100644 --- a/cmk/gui/plugins/userdb/htpasswd.py +++ b/cmk/gui/plugins/userdb/htpasswd.py @@ -101,7 +101,7 @@ class Htpasswd(object): # # For best compatibility in all mentioned situations we use the sha256_crypt # scheme. -def encrypt_password(password): +def hash_password(password): return sha256_crypt.hash(password) diff --git a/cmk/gui/plugins/webapi/webapi.py b/cmk/gui/plugins/webapi/webapi.py index 4a7609f..2501b80 100644 --- a/cmk/gui/plugins/webapi/webapi.py +++ b/cmk/gui/plugins/webapi/webapi.py @@ -37,7 +37,7 @@ import cmk.gui.watolib as watolib from cmk.gui.i18n import _ from cmk.gui.globals import html from cmk.gui.exceptions import MKUserError, MKAuthException, MKException -from cmk.gui.plugins.userdb.htpasswd import encrypt_password +from cmk.gui.plugins.userdb.htpasswd import hash_password from cmk.gui.plugins.webapi import ( APICallCollection, @@ -510,7 +510,7 @@ def action_add_users(request): for user_id, values in users_from_request.items(): user_template = userdb.new_user_template("htpasswd") if "password" in values: - values["password"] = encrypt_password(values["password"]) + values["password"] = hash_password(values["password"]) values["serial"] = 1 user_template.update(values) @@ -553,7 +553,7 @@ def action_edit_users(request): new_password = settings.get("set_attributes", {}).get("password") if new_password: - user_attrs["password"] = encrypt_password(new_password) + user_attrs["password"] = hash_password(new_password) user_attrs["serial"] = user_attrs.get("serial", 0) + 1 edit_user_objects[user_id] = {"attributes": user_attrs, "is_new_user": False} diff --git a/cmk/gui/userdb.py b/cmk/gui/userdb.py index 36fac8d..6756dba 100644 --- a/cmk/gui/userdb.py +++ b/cmk/gui/userdb.py @@ -934,7 +934,7 @@ def create_cmk_automation_user(): 'alias' : u"Check_MK Automation - used for calling web services", 'contactgroups' : [], 'automation_secret' : secret, - 'password' : cmk.gui.plugins.userdb.htpasswd.encrypt_password(secret), + 'password' : cmk.gui.plugins.userdb.htpasswd.hash_password(secret), 'roles' : ['admin'], 'locked' : False, 'serial' : 0, diff --git a/cmk/gui/wato/__init__.py b/cmk/gui/wato/__init__.py index 8715412..4ab60ad 100644 --- a/cmk/gui/wato/__init__.py +++ b/cmk/gui/wato/__init__.py @@ -132,7 +132,6 @@ from cmk.gui.exceptions import MKGeneralException, MKUserError, MKAuthException, from cmk.gui.log import logger from cmk.gui.valuespec import * from cmk.gui.display_options import display_options -from cmk.gui.plugins.userdb.htpasswd import encrypt_password from cmk.gui.plugins.wato.utils.base_modes import WatoMode, WatoWebApiMode from cmk.gui.wato.pages.global_settings import GlobalSettingsMode, EditGlobalSettingMode diff --git a/cmk/gui/wato/pages/users.py b/cmk/gui/wato/pages/users.py index 72ca9fa..60ed7ae 100644 --- a/cmk/gui/wato/pages/users.py +++ b/cmk/gui/wato/pages/users.py @@ -41,7 +41,7 @@ import cmk.gui.forms as forms import cmk.gui.background_job as background_job import cmk.gui.gui_background_job as gui_background_job from cmk.gui.htmllib import HTML -from cmk.gui.plugins.userdb.htpasswd import encrypt_password +from cmk.gui.plugins.userdb.htpasswd import hash_password from cmk.gui.log import logger from cmk.gui.exceptions import MKUserError from cmk.gui.i18n import _, _u @@ -482,7 +482,7 @@ class ModeEditUser(WatoMode): if auth_method == "secret": secret = html.var("_auth_secret", "").strip() user_attrs["automation_secret"] = secret - user_attrs["password"] = encrypt_password(secret) + user_attrs["password"] = hash_password(secret) increase_serial = True # password changed, reflect in auth serial else: @@ -503,7 +503,7 @@ class ModeEditUser(WatoMode): del user_attrs["password"] # which was the encrypted automation password! if password: - user_attrs["password"] = encrypt_password(password) + user_attrs["password"] = hash_password(password) user_attrs["last_pw_change"] = int(time.time()) increase_serial = True # password changed, reflect in auth serial diff --git a/cmk/gui/wato/user_profile.py b/cmk/gui/wato/user_profile.py index 4ae52a0..9626993 100644 --- a/cmk/gui/wato/user_profile.py +++ b/cmk/gui/wato/user_profile.py @@ -35,7 +35,7 @@ import cmk.gui.config as config import cmk.gui.watolib as watolib import cmk.gui.forms as forms import cmk.gui.login as login -from cmk.gui.plugins.userdb.htpasswd import encrypt_password +from cmk.gui.plugins.userdb.htpasswd import hash_password from cmk.gui.exceptions import MKUserError, MKGeneralException, MKAuthException from cmk.gui.i18n import _, _u from cmk.gui.globals import html @@ -187,7 +187,7 @@ def page_user_profile(change_pw=False): raise MKUserError("password2", _("The both new passwords do not match.")) watolib.verify_password_policy(password) - users[config.user.id]['password'] = encrypt_password(password) + users[config.user.id]['password'] = hash_password(password) users[config.user.id]['last_pw_change'] = int(time.time()) if change_pw: diff --git a/omd/packages/omd/omd b/omd/packages/omd/omd index b812e94..81cfccb 100644 --- a/omd/packages/omd/omd +++ b/omd/packages/omd/omd @@ -737,7 +737,7 @@ def calculate_admin_password(options): def set_admin_password(pw): - file("%s/etc/htpasswd" % g_sitedir, "w").write("cmkadmin:%s\n" % encrypt_password(pw)) + file("%s/etc/htpasswd" % g_sitedir, "w").write("cmkadmin:%s\n" % hash_password(pw)) def file_owner_verify(path, user_id, group_id): @@ -4478,7 +4478,7 @@ def random_password(): return ''.join(random.choice(string.ascii_letters + string.digits) for i in range(8)) -def encrypt_password(password): +def hash_password(password): return sha256_crypt.hash(password) #. diff --git a/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py b/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py index ad905c0..c43c907 100644 --- a/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py +++ b/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py @@ -47,11 +47,11 @@ def test_htpasswd_save(htpasswd_file): == saved_file.open(encoding="utf-8").read() -def test_encrypt_password(): - hashed_pw = htpasswd.encrypt_password("blä") +def test_hash_password(): + hashed_pw = htpasswd.hash_password("blä") assert sha256_crypt.verify(u"blä", hashed_pw) - hashed_pw = htpasswd.encrypt_password(u"blä") + hashed_pw = htpasswd.hash_password(u"blä") assert sha256_crypt.verify("blä", hashed_pw)

5 years, 8 months

Centralized htpasswd file operations

by Lars Michelsen

Module: check_mk Branch: master Commit: a957ffa693e0c289d03bb306ff919a125557eb73 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=a957ffa693e0c2… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Mon Oct 22 09:22:37 2018 +0200 Centralized htpasswd file operations * Encapsulated htpasswd file IO and line parsing to dedicated helper class * Added tests for this helper class CMK-1151 Change-Id: Iebf3e3644ee2a4cc462728766e6e3ddec0f92768 --- cmk/gui/plugins/userdb/htpasswd.py | 63 ++++++++++++++++------ cmk/gui/userdb.py | 11 +--- .../unit/cmk/gui/test_userdb_htpasswd_connector.py | 42 +++++++++++++++ 3 files changed, 90 insertions(+), 26 deletions(-) diff --git a/cmk/gui/plugins/userdb/htpasswd.py b/cmk/gui/plugins/userdb/htpasswd.py index 28cb8af..a5ca02e 100644 --- a/cmk/gui/plugins/userdb/htpasswd.py +++ b/cmk/gui/plugins/userdb/htpasswd.py @@ -27,6 +27,8 @@ import time import crypt import os +import pathlib2 as pathlib +from typing import Dict, Text # pylint: disable=unused-import import cmk.store as store import cmk.paths @@ -36,6 +38,45 @@ from cmk.gui.i18n import _ from cmk.gui.exceptions import MKUserError from . import UserConnector, user_connector_registry +class Htpasswd(object): + """Thin wrapper for loading and saving the htpasswd file""" + + def __init__(self, path): + # type: (pathlib.Path) -> None + super(Htpasswd, self).__init__() + self._path = path + + + def load(self): + # type: (None) -> Dict[Text, Text] + """Loads the contents of a valid htpasswd file into a dictionary and returns the dictionary""" + entries = {} + + with self._path.open(encoding="utf-8") as f: + for l in f: + if ':' not in l: + continue + + user_id, pw_hash = l.split(':', 1) + entries[user_id] = pw_hash.rstrip('\n') + + return entries + + + def exists(self, user_id): + """Whether or not a user exists according to the htpasswd file""" + # type: (Text) -> bool + return user_id in self.load() + + + def save(self, entries): + # type: (Dict[Text, Text]) -> None + """Save the dictionary entries (unicode username and hash) to the htpasswd file""" + output = "\n".join("%s:%s" % entry for entry in sorted(entries.iteritems())) + "\n" + store.save_file("%s" % self._path, output.encode("utf-8")) + + + def encrypt_password(password, salt=None, prefix="1"): if not salt: salt = "%06d" % (1000000 * (time.time() % 1.0)) @@ -64,7 +105,7 @@ class HtpasswdUserConnector(UserConnector): # def check_credentials(self, user_id, password): - users = self.load_htpasswd() + users = Htpasswd(pathlib.Path(cmk.paths.htpasswd_file)).load() if user_id not in users: return None # not existing user, skip over @@ -80,19 +121,6 @@ class HtpasswdUserConnector(UserConnector): return os.path.isfile(cmk.paths.var_dir + "/web/" + user_id.encode("utf-8") + "/automation.secret") - # Loads the contents of a valid htpasswd file into a dictionary - # and returns the dictionary - def load_htpasswd(self): - creds = {} - - for line in open(cmk.paths.htpasswd_file, 'r'): - if ':' in line: - user_id, pwhash = line.split(':', 1) - creds[user_id.decode("utf-8")] = pwhash.rstrip('\n') - - return creds - - # Validate hashes taken from the htpasswd file. This method handles # crypt() and md5 hashes. This should be the common cases in the # used htpasswd files. @@ -109,7 +137,7 @@ class HtpasswdUserConnector(UserConnector): # users from htpasswd are lost. If you start managing users with # WATO, you should continue to do so or stop doing to for ever... # Locked accounts get a '!' before their password. This disable it. - output = "" + creds = {} for uid, user in users.items(): # only process users which are handled by htpasswd connector @@ -121,6 +149,7 @@ class HtpasswdUserConnector(UserConnector): locksym = '!' else: locksym = "" - output += "%s:%s%s\n" % (uid.encode("utf-8"), locksym, user["password"]) - store.save_file(cmk.paths.htpasswd_file, output) + creds[uid] = "%s%s" % (locksym, user["password"]) + + Htpasswd(cmk.paths.htpasswd_file).save(creds) diff --git a/cmk/gui/userdb.py b/cmk/gui/userdb.py index 8f7317a..36fac8d 100644 --- a/cmk/gui/userdb.py +++ b/cmk/gui/userdb.py @@ -49,6 +49,7 @@ from cmk.gui.i18n import _ from cmk.gui.globals import html import cmk.gui.plugin_registry import cmk.gui.plugins.userdb +from cmk.gui.plugins.userdb.htpasswd import Htpasswd from cmk.gui.plugins.userdb.utils import ( user_attribute_registry, @@ -240,7 +241,7 @@ def user_exists(username): if _user_exists_according_to_profile(username): return True - return _user_exists_htpasswd(username) + return Htpasswd(cmk.paths.htpasswd_file).exists(username) def _user_exists_according_to_profile(username): @@ -249,14 +250,6 @@ def _user_exists_according_to_profile(username): or os.path.exists(base_path + "serial.mk") -def _user_exists_htpasswd(username): - for line in open(cmk.paths.htpasswd_file): - l = line.decode("utf-8") - if l.startswith("%s:" % username): - return True - return False - - def user_locked(username): users = load_users() return users[username].get('locked', False) diff --git a/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py b/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py new file mode 100644 index 0000000..e4977db --- /dev/null +++ b/tests/unit/cmk/gui/test_userdb_htpasswd_connector.py @@ -0,0 +1,42 @@ +#!/usr/bin/env python +# encoding: utf-8 + +import pytest +import pathlib2 as pathlib + +import cmk.gui.plugins.userdb.htpasswd as htpasswd + +(a)pytest.fixture() +def htpasswd_file(tmpdir): + htpasswd_file = tmpdir.join("htpasswd") + htpasswd_file.write(( + u"bärnd:NEr3kqi287FQc\n" + u"cmkadmin:NEr3kqi287FQc\n" + u"locked:!NEr3kqi287FQc\n" + ).encode("utf-8"), mode="wb") + return pathlib.Path(htpasswd_file) + + +def test_htpasswd_exists(htpasswd_file): + assert htpasswd.Htpasswd(htpasswd_file).exists(u"cmkadmin") + assert htpasswd.Htpasswd(htpasswd_file).exists(u"locked") + assert not htpasswd.Htpasswd(htpasswd_file).exists(u"not-existing") + assert not htpasswd.Htpasswd(htpasswd_file).exists(u"") + assert htpasswd.Htpasswd(htpasswd_file).exists(u"bärnd") + + +def test_htpasswd_load(htpasswd_file): + credentials = htpasswd.Htpasswd(htpasswd_file).load() + assert credentials[u"cmkadmin"] == "NEr3kqi287FQc" + assert isinstance(credentials[u"cmkadmin"], unicode) + assert credentials[u"bärnd"] == "NEr3kqi287FQc" + + +def test_htpasswd_save(htpasswd_file): + credentials = htpasswd.Htpasswd(htpasswd_file).load() + + saved_file = htpasswd_file.with_suffix(".saved") + htpasswd.Htpasswd(saved_file).save(credentials) + + assert htpasswd_file.open(encoding="utf-8").read() \ + == saved_file.open(encoding="utf-8").read()

5 years, 8 months

Add passlib dependency for future GUI password hashing

by Lars Michelsen

Module: check_mk Branch: master Commit: 87d82328a45a83152ab08f91f28d54743bfedf21 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=87d82328a45a83… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Sun Oct 21 12:40:44 2018 +0200 Add passlib dependency for future GUI password hashing CMK-1151 Change-Id: I6e5d6118c1bf298e602f39656cc2d89c466b342c --- Pipfile | 1 + Pipfile.lock | 14 +++++++++++--- omd/packages/python-modules/Makefile | 1 + omd/packages/python-modules/src/passlib-1.7.1.tar.gz | Bin 0 -> 645724 bytes 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/Pipfile b/Pipfile index d5ea49b..75d0bb9 100644 --- a/Pipfile +++ b/Pipfile @@ -91,6 +91,7 @@ oauthlib = "==2.1.0" # needed by azure stuff requests-oauthlib = "==1.0.0" # needed by azure stuff urllib3 = "==1.23" # needed by azure stuff Werkzeug = "==0.14.1" # Added for the GUI +passlib = "==1.7.1" # Added for the GUI [requires] diff --git a/Pipfile.lock b/Pipfile.lock index 04bf3c2..2db1168 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -1,7 +1,7 @@ { "_meta": { "hash": { - "sha256": "9d027b0de5bbce378ae775de1d120dfc174fedf2191341a3081512ccb83eba21" + "sha256": "afb62db7fbdeefe5eb8503ab7b3a78e351578d75f395218d6a48c88d17a4a3fe" }, "pipfile-spec": 6, "requires": { @@ -318,6 +318,14 @@ "index": "pypi", "version": "==2.1.2" }, + "passlib": { + "hashes": [ + "sha256:3d948f64138c25633613f303bcc471126eae67c04d5e3f6b7b8ce6242f8653e0", + "sha256:43526aea08fa32c6b6dbbbe9963c4c767285b78147b7437597f992812f69d280" + ], + "index": "pypi", + "version": "==1.7.1" + }, "pathlib2": { "hashes": [ "sha256:8eb170f8d0d61825e09a95b38be068299ddeda82f35e96c3301a8a5e7604cb83", @@ -754,7 +762,7 @@ "sha256:9d98697f088eb1b0fa451391f91afb5e3ebde16bbdb272819fd091151fda4f1a", "sha256:f0b0e4eba956de51238e17573b7087e852dfe9854afd2e9c873f73fc0ca0a6dd" ], - "markers": "python_version < '3.4'", + "markers": "python_version == '2.7'", "version": "==1.5" }, "backports.ssl-match-hostname": { @@ -883,7 +891,7 @@ "sha256:330cc27ccbf7f1e992e69fef78261dc7c6569012cf397db8d3de0234e6c937ca", "sha256:a7bb0f2cf3a3fd1ab2732cb49eba4252c2af4240442415b4abce3b87022a8f50" ], - "markers": "python_version < '3.3'", + "markers": "python_version < '3.0'", "version": "==1.0.2" }, "futures": { diff --git a/omd/packages/python-modules/Makefile b/omd/packages/python-modules/Makefile index 40d1acf..d40b9f1 100644 --- a/omd/packages/python-modules/Makefile +++ b/omd/packages/python-modules/Makefile @@ -155,6 +155,7 @@ MODULES += requests-oauthlib-1.0.0.tar.gz MODULES += urllib3-1.23.tar.gz # Added for the GUI MODULES += Werkzeug-0.14.1.tar.gz +MODULES += passlib-1.7.1.tar.gz .PHONY: build check-freetds install skel clean diff --git a/omd/packages/python-modules/src/passlib-1.7.1.tar.gz b/omd/packages/python-modules/src/passlib-1.7.1.tar.gz new file mode 100644 index 0000000..1dd64c4 Binary files /dev/null and b/omd/packages/python-modules/src/passlib-1.7.1.tar.gz differ

5 years, 8 months

Analyze configuration: Fixed wrong results for liveproxyd and persistent connection tests

by Lars Michelsen

Module: check_mk Branch: master Commit: 30e881cd5789688d232e387b7dbea6fdf396af1e URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=30e881cd578968… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Wed Oct 24 14:47:49 2018 +0200 Analyze configuration: Fixed wrong results for liveproxyd and persistent connection tests Previously all analyze configuration tests were executed locally on each site. In case of the liveproxyd tests and persistent connection tests this was wrong because the tests have to check the connection configuration for a specific site on the central site. The following things have been changed: * These tests are only triggered on the central sites (see is_relevant()). * Test results produced on one site can now set the site_id attribute to the site_id of another site. These results will not be merged together like it is done for multiple results affecting a single site. These results will then be shown in the column of the desired site instead of the site they were executed on Change-Id: Ie4a6edf0dfcdd7d5b025f244d1f767b987bbfa62 --- cmk/gui/plugins/wato/ac_tests.py | 24 +++++++++++++++++++----- cmk/gui/watolib.py | 12 +++++++++++- 2 files changed, 30 insertions(+), 6 deletions(-) diff --git a/cmk/gui/plugins/wato/ac_tests.py b/cmk/gui/plugins/wato/ac_tests.py index 073656f..c1b2bdd 100644 --- a/cmk/gui/plugins/wato/ac_tests.py +++ b/cmk/gui/plugins/wato/ac_tests.py @@ -70,12 +70,19 @@ class ACTestPersistentConnections(ACTest): def is_relevant(self): - return True + # This check is only executed on the central instance of multisite setups + return len(config.sitenames()) > 1 def execute(self): - site_id = config.omd_site() - site_config = config.site(site_id) + for site_id in config.sitenames(): + site_config = config.site(site_id) + for result in self._check_site(site_id, site_config): + result.site_id = site_id + yield result + + + def _check_site(self, site_id, site_config): persist = site_config.get("persist", False) if persist and watolib.site_is_using_livestatus_proxy(site_id): @@ -114,11 +121,18 @@ class ACTestLiveproxyd(ACTest): def is_relevant(self): - return True + # This check is only executed on the central instance of multisite setups + return len(config.sitenames()) > 1 def execute(self): - site_id = config.omd_site() + for site_id in config.sitenames(): + for result in self._check_site(site_id): + result.site_id = site_id + yield result + + + def _check_site(self, site_id): if watolib.site_is_using_livestatus_proxy(site_id): yield ACResultOK(_("Site is using the Livestatus Proxy Daemon")) diff --git a/cmk/gui/watolib.py b/cmk/gui/watolib.py index 2dae2f4..ba7bc89 100644 --- a/cmk/gui/watolib.py +++ b/cmk/gui/watolib.py @@ -10029,6 +10029,7 @@ class ACResult(object): def __init__(self, text): super(ACResult, self).__init__() self.text = text + self.site_id = config.omd_site() def from_test(self, test): @@ -10036,7 +10037,6 @@ class ACResult(object): self.category = test.category() self.title = test.title() self.help = test.help() - self.site_id = config.omd_site() @classmethod @@ -10172,6 +10172,16 @@ class ACTest(object): def run(self): self._executed = True try: + # Do not merge results that have been gathered on one site for different sites + results = list(self.execute()) + num_sites = len(set(r.site_id for r in results)) + if num_sites > 1: + for result in results: + result.from_test(self) + yield result + return + + # Merge multiple results produced for a single site total_result = ACResult.merge(*list(self.execute())) total_result.from_test(self) yield total_result

5 years, 8 months

← Newer
1
2
3
4
5
6
7
8
...
31
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

Checkmk git commits October 2018