[checkmk-commits] 4734 FIX check_mail check_mail_loop check_mailboxes check_sql:

Passwords from password store were not used correctly Message-ID: &lt;5923d97b.YLRO+V5/jstegUrt%lm(a)mathias-kettner.de&gt; User-Agent: Heirloom mailx 12.5 6/20/10 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Module: check_mk Branch: master Commit: d4346412293d5014aa76c47ada0b354c13957afd URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=d4346412293d50… Author: Lars Michelsen &lt;lm(a)mathias-kettner.de&gt; Date: Tue May 23 08:35:24 2017 +0200 4734 FIX check_mail check_mail_loop check_mailboxes check_sql: Passwords from password store were not used correctly Change-Id: I850e042f9503c2b4f018839c387a892bdbd5d5d7 --- .werks/4734 | 11 +++++ active_checks/check_mail | 3 ++ active_checks/check_mail_loop | 4 ++ active_checks/check_mailboxes | 3 ++ active_checks/check_sql | 2 + lib/password_store.py | 108 ++++++++++++++++++++++++++++++++++++++++++ modules/check_mk.py | 11 +---- 7 files changed, 133 insertions(+), 9 deletions(-) diff --git a/.werks/4734 b/.werks/4734 new file mode 100644 index 0000000..19494e4 --- /dev/null +++ b/.werks/4734 @@ -0,0 +1,11 @@ +Title: check_mail check_mail_loop check_mailboxes check_sql: Passwords from password store were not used correctly +Level: 1 +Component: checks +Class: fix +Compatible: compat +Edition: cre +State: unknown +Version: 1.5.0i1 +Date: 1495521285 + + diff --git a/active_checks/check_mail b/active_checks/check_mail index 44f2751..3df39af 100755 --- a/active_checks/check_mail +++ b/active_checks/check_mail @@ -28,6 +28,9 @@ import sys, getopt, os, time, random, poplib, imaplib, email import traceback, socket, re import base64 +import cmk.password_store +cmk.password_store.replace_passwords() + def parse_exception(e): e = str(e) if e[0] == '{': diff --git a/active_checks/check_mail_loop b/active_checks/check_mail_loop index 25a57b3..9af4e9c 100755 --- a/active_checks/check_mail_loop +++ b/active_checks/check_mail_loop @@ -29,6 +29,10 @@ import traceback, socket, re from email.mime.text import MIMEText +import cmk.password_store +cmk.password_store.replace_passwords() + + def parse_exception(e): e = str(e) if e[0] == '{': diff --git a/active_checks/check_mailboxes b/active_checks/check_mailboxes index 73c6694..ece1a17 100755 --- a/active_checks/check_mailboxes +++ b/active_checks/check_mailboxes @@ -37,6 +37,9 @@ import socket import traceback from optparse import OptionParser +import cmk.password_store +cmk.password_store.replace_passwords() + class Mail(object): diff --git a/active_checks/check_sql b/active_checks/check_sql index 18a88b2..ee0237f 100755 --- a/active_checks/check_sql +++ b/active_checks/check_sql @@ -34,6 +34,8 @@ import sys import getopt import os +import cmk.password_store +cmk.password_store.replace_passwords() def usage(): sys.stderr.write("""Check_MK SQL Test diff --git a/lib/password_store.py b/lib/password_store.py new file mode 100644 index 0000000..c2254ce --- /dev/null +++ b/lib/password_store.py @@ -0,0 +1,108 @@ +#!/usr/bin/python +# -*- encoding: utf-8; py-indent-offset: 4 -*- +# +------------------------------------------------------------------+ +# | ____ _ _ __ __ _ __ | +# | / ___| |__ ___ ___| | __ | \/ | |/ / | +# | | | | '_ \ / _ \/ __| |/ / | |\/| | ' / | +# | | |___| | | | __/ (__| < | | | | . \ | +# | \____|_| |_|\___|\___|_|\_\___|_| |_|_|\_\ | +# | | +# | Copyright Mathias Kettner 2016 mk(a)mathias-kettner.de | +# +------------------------------------------------------------------+ +# +# This file is part of Check_MK. +# The official homepage is at http://mathias-kettner.de/check_mk. +# +# check_mk is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation in version 2. check_mk is distributed +# in the hope that it will be useful, but WITHOUT ANY WARRANTY; with- +# out even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. See the GNU General Public License for more de- +# tails. You should have received a copy of the GNU General Public +# License along with GNU Make; see the file COPYING. If not, write +# to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, +# Boston, MA 02110-1301 USA. + +"""This module is meant to be used by active checks that support getting +credentials from the Check_MK password store. + +The module needs to be included and then the script needs to run the +replace_passwords() function. This should be done early in the script +to make the pwstore option handling transparent for the script. + +Do it like this: + + import cmk.password_store + cmk.password_store.replace_passwords() + +""" + +import sys + +import cmk.paths +import cmk.store as store + +password_store_path = cmk.paths.var_dir + "/stored_passwords" + +def bail_out(s): + sys.stdout.write("UNKNOWN - %s\n" % s) + sys.exit(3) + + +def replace_passwords(): + if len(sys.argv) < 2: + return # command line too short + + if not [ a for a in sys.argv if a.startswith("--pwstore") ]: + return # no password store in use + + # --pwstore=4@4@web,6@0@foo + # In the 4th argument at char 4 replace the following bytes + # with the passwords stored under the ID 'web' + # In the 6th argument at char 0 insert the password with the ID 'foo' + + # Extract first argument and parse it + + pwstore_args = sys.argv.pop(1).split("=", 1)[1] + passwords = load() + + for password_spec in pwstore_args.split(","): + parts = password_spec.split("@") + if len(parts) != 3: + bail_out("pwstore: Invalid --pwstore entry: %s" % password_spec) + + try: + num_arg, pos_in_arg, password_id = int(parts[0]), int(parts[1]), parts[2] + except ValueError: + bail_out("pwstore: Invalid format: %s" % password_spec) + + try: + arg = sys.argv[num_arg] + except IndexError: + bail_out("pwstore: Argument %d does not exist" % num_arg) + + try: + password = passwords[password_id] + except KeyError: + bail_out("pwstore: Password '%s' does not exist" % password_id) + + sys.argv[num_arg] = arg[:pos_in_arg] \ + + password \ + + arg[pos_in_arg+len(password):] + + +def save(stored_passwords): + content = "" + for ident, pw in stored_passwords.items(): + content += "%s:%s\n" % (ident, pw["password"]) + + store.save_file(password_store_path, content) + + +def load(): + passwords = {} + for line in open(password_store_path): + ident, password = line.strip().split(":", 1) + passwords[ident] = password + return passwords diff --git a/modules/check_mk.py b/modules/check_mk.py index 3141fa7..54383b6 100755 --- a/modules/check_mk.py +++ b/modules/check_mk.py @@ -56,6 +56,7 @@ import cmk.store as store import cmk.paths import cmk.render as render import cmk.man_pages as man_pages +import cmk.password_store import cmk_base import cmk_base.console as console @@ -2828,7 +2829,7 @@ def create_core_config(): out = file(cmk.paths.nagios_objects_file, "w") create_nagios_config(out) - write_stored_passwords() + cmk.password_store.save(stored_passwords) num_warnings = len(g_configuration_warnings) if num_warnings > 10: @@ -2883,14 +2884,6 @@ def verify_cluster_address_family(hostname): (hostname, ", ".join(address_families))) -def write_stored_passwords(): - content = "" - for ident, pw in stored_passwords.items(): - content += "%s:%s\n" % (ident, pw["password"]) - - store.save_file(cmk.paths.var_dir + "/stored_passwords", content) - - def get_cluster_nodes_for_config(hostname): verify_cluster_address_family(hostname)