pax_global_header00006660000000000000000000000064125750301730014515gustar00rootroot0000000000000052 comment=5fe6a702d5b5f66c1dae4e240bd4c823e82ff5bc securepass-tools-0.4.3/000077500000000000000000000000001257503017300150345ustar00rootroot00000000000000securepass-tools-0.4.3/.gitignore000066400000000000000000000011041257503017300170200ustar00rootroot00000000000000*.py[cod] # C extensions *.so # Packages *.egg *.egg-info dist build eggs parts #bin var sdist develop-eggs .installed.cfg lib lib64 __pycache__ # Installer logs pip-log.txt # Unit test / coverage reports .coverage .tox nosetests.xml # Translations *.mo # Mr Developer .mr.developer.cfg .project .pydevproject # OS generated files .DS_Store .DS_Store? ._* .Spotlight-V100 .Trashes Icon? ehthumbs.db Thumbs.db ## Ignore Pycharm .idea/* test_sp.py ## Vagrant Vagrantfile .vagrant* contrib/vagrant.yml ## Ingnore conf securepass.conf dist/* securepass.egg-info/* active.sh securepass-tools-0.4.3/CHANGELOG.md000066400000000000000000000021621257503017300166460ustar00rootroot00000000000000CHANGELOG ========= # 0.4.3 * Fix import statements in the Django module * Drop optparse in favor of argparse # 0.4.2 * Fixes for RPM packaging # 0.4.1 * SSH key helper for OpenSSH * Initial SP config file creator/updater # 0.4.0 * Updated RPM spec * sync with nss-ldap versioning * Improved configuration load # 0.3.7 * Privacy bit * ssh key extractor * Privacy bit on client * First RPM spec * logs format changed * Started logging viewing * License stuffs # v0.3.6 * 0.3.6 released # v0.3.5 * Moved files into subdirectory, ready for pip packaging * Modified utils and setup, ready for refactoring. * Added setup for python (preliminary) Added support for virtualenv * bug in setting extended attrs * Tag for 0.3 # v0.3 * More functinalities * * Change global debug flag to -D * Added password change/disable for user(s) * RADIUS CLI tools * Added tools for apps and user * Added users cli tools * README update * Django experimental backend added * README update * adding some utilities, API fixed * manifest file update * First user APIs * Initial commit, app operations * Initial commit securepass-tools-0.4.3/COPYING000066400000000000000000000004741257503017300160740ustar00rootroot00000000000000SecurePass tools is released under GPL-2+ Copyright (C) 2008-2013 Giuseppe Paterno' (gpaterno@gpaterno.com) GARL Sagl (info@garl.ch) It contains some lines of codes from the Ganeti Project. By the time of copying, the rapi/client.py was under GPLv2 Copyright (C) 2010, 2011, 2012 Google Inc securepass-tools-0.4.3/LICENSE000066400000000000000000000431521257503017300160460ustar00rootroot00000000000000GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. {description} Copyright (C) {year} {fullname} This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. {signature of Ty Coon}, 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. securepass-tools-0.4.3/MANIFEST.in000066400000000000000000000000621257503017300165700ustar00rootroot00000000000000include README.md include securepass.conf.example securepass-tools-0.4.3/Makefile000066400000000000000000000001071257503017300164720ustar00rootroot00000000000000clean: rm -rf dist/ rm -rf securepass.egg-info/ rm securepass/*.pyc securepass-tools-0.4.3/README.md000066400000000000000000000030311257503017300163100ustar00rootroot00000000000000SecurePass public CLI tools =========================== The tools for accessing SecurePass from command line. Uses the SecurePass public APIs to manage. More information on the APIs here: https://beta.secure-pass.net/ Note: For OS X, ensure you have the following while compiling pycurl: export PYCURL_SSL_LIBRARY=openssl This program is released under GPLv2 See LICENSE file for details Configuration file ================== Configuration *only for cli tools* should be placed in: /etc/securepass.conf /usr/local/etc/securepass.conf or securepass.conf in current local directory. For an example check out securepass.conf.example Django Backend ============== The Django backend for SecurePass RESTful APIs authenticated and sync information from SecurePass (first name, last name, e-mail) each time, so that information is up to date. Also state of enable/disable is reflected in is_active, so that the user is automatically disabled. Note: we do not handle staff at this time. For future that will be reflected into groups. The following settings have to be put into settings.py Required: ``` SP_APP_ID = <> SP_APP_SECRET = <> ``` Optional: ``` SP_ENDPOINT = <> SP_AUTOCREATE_USER = <> ``` Put securepass-tools in installed apps ``` INSTALLED_APPS += ( 'securepass-tools', ) ``` Put the django authentication backend ``` AUTHENTICATION_BACKENDS = ( 'securepass-tools.djangoauth.SecurePassAuthBackend', ) ``` securepass-tools-0.4.3/README.txt000066400000000000000000000006121257503017300165310ustar00rootroot00000000000000The tools for accessing SecurePass from command line. Uses the SecurePass public APIs to manage and this is the public reference for the APIs themselves. This program is released under GPLv2. See LICENSE file for details. More information on the APIs here: https://beta.secure-pass.net/ Note: For OS X, ensure you have the following while compiling pycurl: export PYCURL_SSL_LIBRARY=openssl securepass-tools-0.4.3/bin/000077500000000000000000000000001257503017300156045ustar00rootroot00000000000000securepass-tools-0.4.3/bin/sp-app-add000077500000000000000000000056271257503017300174720ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Add application ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from securepass import utils from securepass import securepass import logging from argparse import ArgumentParser parser = ArgumentParser( description="Add application in SecurePass", prog="sp-app-add", ) parser.add_argument('-D', '--debug', action='store_true', default=False, dest="debug_flag", help="Enable debug output",) parser.add_argument('-4', '--ipv4', default="0.0.0.0/0", action='store', dest="ipv4", help="Restrict to IPv4 network (default: 0.0.0.0/0)",) parser.add_argument('-6', '--ipv6', default="::/0", action='store', dest="ipv6", help="Restrict to IPv6 network (default: ::/0)",) parser.add_argument('-g', '--group', default="", action='store', dest="group", help="Group name (restriction)",) parser.add_argument('-r', '--realm', action='store', dest="realm", help="Set alternate realm",) parser.add_argument('-w', '--write', action='store_true', dest="write", default=False, help="Write capabilites (default readonly)",) parser.add_argument('-p', '--privacy', action='store_true', dest="privacy", default=False, help="Privacy flag (default no)",) parser.add_argument('label', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Add the user logging.debug("Adding application %s" % values.label) try: result = sp_handler.app_add(label=values.label, allow_network_ipv4=values.ipv4, allow_network_ipv6=values.ipv6, write=values.write, realm=values.realm, group=values.group.strip().lower(), privacy=values.privacy) print "Application ID: %s" % result['app_id'] print "Application Secret: %s" % result['app_secret'] print "" print "Please save the above results, secret will be no longer displayed for security reasons." except Exception as e: print e securepass-tools-0.4.3/bin/sp-app-del000077500000000000000000000025411257503017300174760ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Application remove ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Delete an application from SecurePass", prog="sp-app-del", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('appid', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## ask & remove choice = raw_input( "Do you want to delete application %s (Y/N)? " % values.appid ).lower() try: if choice in ("yes", "y"): sp_handler.app_delete(app_id=values.appid) exit(1) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-app-info000077500000000000000000000034371257503017300176720ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Detail of an application ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Retrieve application's details from SecurePass", prog="sp-app-info", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('appid', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Display info try: myapp = sp_handler.app_info(app_id=values.appid) print "Application details for %s" % values.appid print "================================================\n" print "Label..............: %s" % myapp['label'] print "Realm..............: %s" % myapp['realm'] print "Restrict to group..: %s" % myapp['group'] print "Permissions........:", if myapp['write']: print "read/write" else: print "read-only" print "IPv4 network ACL...: %s" % myapp['allow_network_ipv4'] print "IPv6 network ACL...: %s" % myapp['allow_network_ipv6'] print "Privacy mode ......: %s" % myapp['privacy'] except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-app-mod000077500000000000000000000057561257503017300175240ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Modify application ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Modify an application in SecurePass", prog="sp-app-mod", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-l', '--label', default=None, action='store', dest="label", help="Label",) parser.add_argument('-4', '--ipv4', default=None, action='store', dest="ipv4", help="Restrict to IPv4 network",) parser.add_argument('-6', '--ipv6', default=None, action='store', dest="ipv6", help="Restrict to IPv6 network",) parser.add_argument('-g', '--group', default=None, action='store', dest="group", help="Group name (restriction)",) parser.add_argument('-w', '--write', action='store_true', dest="write", default=False, help="Write capabilites",) parser.add_argument('-r', '--read', action='store_true', dest="read", default=False, help="Readonly capabiliteies",) parser.add_argument('appid', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Add the user logging.debug("Modifying application %s" % values.appid) try: ## Grabbing previous configuration myapp = sp_handler.app_info(values.appid) if values.label is not None: myapp['label'] = values.label if values.ipv4 is not None: myapp['allow_network_ipv4'] = values.ipv4 if values.ipv6 is not None: myapp['allow_network_ipv6'] = values.ipv6 if values.group is not None: myapp['group'] = values.group.strip() if values.write: myapp['write'] = True if values.read: myapp['write'] = False result = sp_handler.app_modify( app_id=values.appid, label=myapp['label'], allow_network_ipv4=myapp['allow_network_ipv4'], allow_network_ipv6=myapp['allow_network_ipv6'], write=myapp['write'], group=myapp['group'] ) sys.exit(0) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-apps000077500000000000000000000034071257503017300171210ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Application list ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="List applications in SecurePass", prog="sp-apps", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-d', '--details', action='store_true', dest="detail_flag", help="Enable debug output",) parser.add_argument('-r', '--realm', action='store', dest="realm", help="Set alternate realm",) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## List all apps if values.detail_flag: print "%-45s %-30s" % ("App ID", "Label") print "==========================================================================" try: for app in sp_handler.app_list(realm=values.realm): if values.detail_flag: app_detail = sp_handler.app_info(app_id=app) print "%-45s %-30s" % (app, app_detail['label']) else: print app except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-config000077500000000000000000000073251257503017300174260ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Create/update SecurePass configuration file ## to be used in cloudinit, kickstart or similar technologies ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser import logging import ConfigParser import os import sys parser = ArgumentParser( description="Create or update SecurePass configuration file", prog="sp-config", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-c', '--config', default='/etc/securepass.conf', action='store', dest="configfile", help="Config file",) parser.add_argument('-i', '--appid', default=None, action='store', dest="appid", help="Application ID",) parser.add_argument('-e', '--endpoint', default='https://beta.secure-pass.net', action='store', dest="endpoint", help="Endpoint URL",) parser.add_argument('-s', '--appsecret', default=None, action='store', dest="appsecret", help="Application Secret",) parser.add_argument('-r', '--realm', default=None, action='store', dest="realm", help="Default Domain/Realm (and allow NSS login)",) parser.add_argument('--root', default=None, action='store', dest="root", help="Coma separated list of allowed root users",) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) # Fixup of the DEFAULT def replace_word(infile, old_word, new_word): if not os.path.isfile(infile): print ("Error on replace_word, not a regular file: "+infile) sys.exit(1) f1 = open(infile, 'r').read() f2 = open(infile, 'w') m = f1.replace(old_word, new_word) f2.write(m) ## Open the file config = ConfigParser.RawConfigParser() logging.debug("Config file is: %s" % values.configfile) # Before updating, we need to setup default ot DEFAULT :( # blaming configparser here :( replace_word(values.configfile, "[default]", "[DEFAULT]") # Open and update config.read(values.configfile) if values.appid is not None: config.set("DEFAULT", "app_id", values.appid) if values.appsecret is not None: config.set("DEFAULT", "app_secret", values.appsecret) # Endpoint config.set("DEFAULT", "endpoint", values.endpoint) # Set the realm if values.realm is not None: # It might be that the section is just not there # if not, let's create and populate defaults if not config.has_section("nss"): config.add_section("nss") if not config.has_option("nss", "default_gid"): config.set("nss", "default_gid", 100) if not config.has_option("nss", "default_home"): config.set("nss", "default_home", '"/home"') if not config.has_option("nss", "default_shell"): config.set("nss", "default_shell", '"/bin/bash"') config.set("nss", "realm", values.realm) # Set root users if values.root is not None: # Create the section if is not there if not config.has_section("ssh"): config.add_section("ssh") config.set("ssh", "root", values.root) # Final write with open(values.configfile, 'w') as inifile: config.write(inifile) # Fixup for [DEFAULT] in uppercase replace_word(values.configfile, "[DEFAULT]", "[default]") securepass-tools-0.4.3/bin/sp-group-member000077500000000000000000000035011257503017300205520ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Test group membership ## Exits 0 if ok, 1 if not belongs ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Test group membership for a SecurePass user", prog="sp-group-member", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-o', '--no-output', action='store_true', dest="nooutput_flag", help="Suppress output",) parser.add_argument('userid', action='store') parser.add_argument('group', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Test the actual authentication try: if sp_handler.group_member(user=values.userid, group=values.group): if not values.nooutput_flag: print "User %s belongs to group %s!" % ( values.userid, values.group) sys.exit(0) else: if not values.nooutput_flag: sys.exit("User %s not in group %s!" % ( values.userid, values.group)) except Exception as e: if not values.nooutput_flag: sys.exit(e) sys.exit(1) securepass-tools-0.4.3/bin/sp-logs000077500000000000000000000045161257503017300171240ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Show and send logs ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Show logs for SecurePass", prog="sp-logs", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-r', '--realm', action='store', dest="realm", help="Set alternate realm",) parser.add_argument('-s', '--start', action='store', dest="start", help="Start date (format: YYYY-MM-DD)",) parser.add_argument('-e', '--end', action='store', dest="end", help="End date (format: YYYY-MM-DD)",) parser.add_argument('-c', '--csv', action='store_true', dest="full_flag", help="Enable csv full output",) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Need to display also log level and application, maybe as optional ## Go for the logs try: all_logs = sp_handler.get_logs( realm=values.realm, start=values.start, end=values.end)['logs'] ## print csv header if values.full_flag: print "timestamp;uuid;message;realm;app;level" ## Sort the return dict for time for time in sorted(all_logs): if values.full_flag: print "%s;%s;%s;%s;%s;%s" % ( time, all_logs[time]['uuid'], all_logs[time]['message'], all_logs[time]['realm'], all_logs[time]['app'], all_logs[time]['level'] ) else: print "%-19s %s" % (time, all_logs[time]['message']) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-radius-add000077500000000000000000000043071257503017300201730ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Add a RADIUS device ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Add a RADIUS in SecurePass", prog="sp-radius-add", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-f', '--fqdn', default=None, action='store', dest="fqdn", help="FQDN/Name",) parser.add_argument('-s', '--secret', default=None, action='store', dest="secret", help="Shared Secret",) parser.add_argument('-g', '--group', default=None, action='store', dest="group", help="Group name (restriction)",) parser.add_argument('-R', '--rfid', action='store_true', dest="rfid", default=False, help="Enable RFID tag as username",) parser.add_argument('-r', '--realm', action='store', dest="realm", help="Set alternate realm",) parser.add_argument('radiusip', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Add the user logging.debug("Adding RADIUS %s" % values.radiusip) try: result = sp_handler.radius_add( radius=values.radiusip, name=values.fqdn, secret=values.secret, rfid=values.rfid, group=values.group, realm=values.realm) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-radius-del000077500000000000000000000025671257503017300202150ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Remove a RADIUS remove ## ## (c) 2014 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Delete a RADIUS in SecurePass", prog="sp-radius-del", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('radiusip', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## ask & remove choice = raw_input( "Do you want to delete RADIUS %s (Y/N)? " % values.radiusip ).lower() try: if choice in ("yes", "y"): sp_handler.radius_del(radius=values.radiusip) sys.exit(0) else: sys.exit(1) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-radius-info000077500000000000000000000032251257503017300203740ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Detail of an application ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( usage="Retrieve RADIUS details from SecurePass", prog="sp-radius-info", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('radiusip', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Display info try: radius = sp_handler.radius_info(radius=values.radiusip) print "RADIUS details for %s" % values.radiusip print "================================================\n" print "FQDN/Name..........: %s" % radius['name'] print "Secret.............: %s" % radius['secret'] print "Realm..............: %s" % radius['realm'] print "Restrict to group..: %s" % radius['group'] print "RFID tag...........:", if radius['rfid']: print "enabled" else: print "disabled" except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-radius-list000077500000000000000000000035011257503017300204110ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Radius list ## ## (c) 2014 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="List RADIUS devices in SecurePass", prog="sp-radius-list", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-d', '--details', action='store_true', dest="details_flag", help="Show details",) parser.add_argument('-r', '--realm', action='store', dest="realm", default=None, help="Set alternate realm",) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## List all apps if values.details_flag: print "%-45s %-30s" % ("RADIUS", "FQDN") print "=============================================================================" try: for radius in sp_handler.radius_list(realm=values.realm): if values.details_flag: radius_detail = sp_handler.radius_info(radius=radius) print "%-45s %-30s" % (radius, radius_detail['name']) else: print radius except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-radius-mod000077500000000000000000000056321257503017300202240ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Modify RADIUS ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Modify a RADIUS in SecurePass", prog="sp-radius-mod", ) rfid_parser = parser.add_mutually_exclusive_group(required=False) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-f', '--fqdn', default=None, action='store', dest="fqdn", help="FQDN/Name",) parser.add_argument('-s', '--secret', default=None, action='store', dest="secret", help="Shared Secret",) parser.add_argument('-g', '--group', default=None, action='store', dest="group", help="Group name (restriction)",) rfid_parser.add_argument('-R', '--rfid', action='store_true', dest="rfid", help="Enable RFID tag as username",) rfid_parser.add_option('-n', '--no-rfid', action='store_false', dest="rfid", help="Disable RFID tag as username",) parser.add_argument('-r', '--realm', action='store', dest="realm", help="Set alternate realm",) parser.add_argument('radiusip', action='store') parser.set_defaults(rfid=None) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Add the user logging.debug("Modifying RADIUS %s" % values.radiusip) try: ## Grabbing previous configuration radius = sp_handler.radius_info(values.radiusip) if values.fqdn is not None: radius['name'] = values.fqdn if values.secret is not None: radius['secret'] = values.secret if values.group is not None: radius['group'] = values.group.strip() if values.rfid is not None: radius['rfid'] = values.rfid result = sp_handler.radius_modify(radius=values.radiusip, name=radius['name'], secret=radius['secret'], rfid=radius['rfid'], group=radius['group']) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-realm-xattrs000077500000000000000000000052221257503017300205760ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Extended attributes operations on realm ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys operations = ("list", "set", "delete") parser = ArgumentParser( description="Operate on realms' extended attributes in SecurePass", prog="sp-realm-xattrs", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('realm', action='store') parser.add_argument('operation', action='store', choices=operations) parser.add_argument('attribute', nargs="?", default=None) parser.add_argument('value', nargs="?", default=None) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) realm = values.realm operation = values.operation op_attribute = values.attribute op_value = values.value ## If list operation specified if operation == "list": ## Display info try: attributes = sp_handler.realms_xattr_list(realm=realm) print "Extended attributes details for %s" % realm print "================================================\n" for attribute, value in attributes.items(): print "%s: %s" % (attribute, value) except Exception as e: sys.exit(e) elif operation == "set": # Set values if op_attribute is None or op_value is None: sys.exit( "Couldn't find either attribute or value: set " ) ## Set value try: sp_handler.realms_xattr_set( realm=realm, attribute=op_attribute, value=op_value ) print "Attribute %s set for realm %s" % (op_attribute, realm) except Exception as e: sys.exit(e) elif operation == "delete": # Delete if op_attribute is None: sys.exit( "Couldn't find attribute: delete " ) try: sp_handler.realms_xattr_delete(realm=realm, attribute=op_attribute) print "Attribute %s deleted for realm %s" % (op_attribute, realm) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-sshkey000077500000000000000000000045561257503017300174720ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Get SSH for a given user ## helper for AuthorizedKeysCommand in OpenSSSH ## ## In securepass.conf specify: ## [nss] and realm = myrealm to assign default realm ## [ssh] and root = user,user to assign root keys ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging def get_user_key(handler, username): # Output the ssh key, if found as attribute # TODO: Need to put some caching here try: attributes = handler.users_xattr_list(user=username) return attributes.get("sshkey", None) except Exception: return None # Autoappend the realm def expand_user(user): if not '@' in user and 'realm' in config: return "%s@%s" % (user, config['realm']) else: return user parser = ArgumentParser( description="List user's SSH keys", prog="sp-sshkey", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-r', '--realm', action='store', dest="realm", help="Set alternate realm",) parser.add_argument('username', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Check if we have a domain, otherwise append username = expand_user(values.username) logging.debug("Username is: %s" % username) # Special case for root, otherwise print ssh key if username.split("@")[0] == 'root' and 'root' in config: logging.debug("root request detected, cycling for users") for user in config['root'].split(','): key = get_user_key(sp_handler, expand_user(user)) if key is not None: print key else: key = get_user_key(sp_handler, username) if key is not None: print key securepass-tools-0.4.3/bin/sp-user-add000077500000000000000000000053161257503017300176630ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Users add ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Add user in SecurePass", prog="sp-user-add", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-n', '--name', required=True, action='store', dest="name", help="First name",) parser.add_argument('-s', '--surname', required=True, default=None, action='store', dest="surname", help="Last name",) parser.add_argument('-e', '--email', required=True, action='store', dest="email", help="E-mail address",) parser.add_argument('-m', '--mobile', required=True, action='store', dest="mobile", help="Mobile number",) parser.add_argument('--nin', default=None, action='store', dest="nin", help="National Identification Number (optional)",) parser.add_argument('--rfid', default=None, action='store', dest="rfid", help="RFID tag (optional)",) parser.add_argument('--manager', default=None, action='store', dest="manager", help="Manager user id (optional)",) parser.add_argument('userid', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Add the user logging.debug("Adding user %s" % values.userid) try: sp_handler.user_add(user=values.userid, name=values.name, surname=values.surname, email=values.email, mobile=values.mobile, nin=values.nin, rfid=values.rfid, manager=values.manager) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-user-auth000077500000000000000000000033111257503017300200650ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Test authentication ## Exits 0 if ok, 1 if not authenticated ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Test authentication for SecurePass", prog="sp-user-auth", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-o', '--no-output', action='store_true', dest="nooutput_flag", help="Suppress output",) parser.add_argument("username", action="store") parser.add_argument("password", action="store") values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) # Test the actual authentication try: if sp_handler.user_auth(user=values.username, secret=values.password): if not values.nooutput_flag: print "Authenticated!" else: if not values.nooutput_flag: sys.exit("Access denied.") except Exception as e: if not values.nooutput_flag: sys.exit(e) sys.exit(1) securepass-tools-0.4.3/bin/sp-user-del000077500000000000000000000024621257503017300176760ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Users remove ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Delete a user in SecurePass", prog="sp-user-del", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument("userid", action="store") values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## ask & remove userid = values.userid choice = raw_input( "Do you want to delete user %s (Y/N)? " % userid ).lower() try: if choice in ("y", "yes"): sp_handler.user_del(user=userid) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-user-info000077500000000000000000000036101257503017300200610ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Detail of a user ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Get user details from SecurePass", prog="sp-user-info", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('userid', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Display info try: myuser = sp_handler.user_info(user=values.userid) print "User details for %s" % values.userid print "================================================\n" print "Name.............: %s" % myuser['name'] print "Surname..........: %s" % myuser['surname'] print "E-mail...........: %s" % myuser['email'] print "Mobile nr........: %s" % myuser['mobile'] print "National ID......: %s" % myuser['nin'] print "RFID tag.........: %s" % myuser['rfid'] print "Token type.......: %s" % myuser['token'] print "User status......:", if myuser['enabled']: print "Enabled" else: print "Disabled" print "Password status..:", if myuser['password']: print "Enabled" else: print "Disabled" except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-user-mod000077500000000000000000000031751257503017300177130ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Modify a given user ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="Modify user in SecurePass", prog="sp-user-mod", ) enable_parser = parser.add_mutually_exclusive_group(required=False) parser.add_argument( '-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output", ) enable_parser.add_argument( '-d', '--disable', action='store_false', dest="enable_flag", help="Disable user", ) enable_parser.add_argument( '-e', '--enable', action='store_true', dest="enable_flag", help="Enable user", ) parser.add_argument('userid', action='store') parser.set_defaults(enable_flag=None) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) try: ## Disable user if values.enable_flag is False: sp_handler.user_disable(values.userid) ## Enable user elif values.enable_flag is True: sp_handler.user_enable(values.userid) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-user-passwd000077500000000000000000000040121257503017300204240ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Change/disable user's password ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import getpass import logging import sys parser = ArgumentParser( description="Change or disable user password for SecurePass", prog="sp-user-passwd", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-d', '--disable', action='store_true', dest="disable_flag", default=False, help="Disable user's password",) parser.add_argument('username', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) username = values.username if values.disable_flag: # was asked to disable password try: sp_handler.user_password_disable(values.username.strip()) print "Password removed." except Exception as e: sys.exit(e) sys.exit(0) else: # was asked to change the password password = getpass.getpass() verifypw = getpass.getpass(prompt='Verify Password: ') ## if matches if password == verifypw: try: sp_handler.user_password_change( user=username, password=password ) print "Password changed." except Exception as e: sys.exit(e) else: sys.exit("Passwords don't match!") securepass-tools-0.4.3/bin/sp-user-provision000077500000000000000000000027711257503017300211650ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Provision a given user ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys token_types = ('iphone', 'android', 'blackberry', 'software') parser = ArgumentParser( description="Provision SecurePass user", prog="sp-user-provision", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-t', '--token', action='store', dest="token", choices=token_types, default='software', help="Select token type",) parser.add_argument('userid', action='store') values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## Send provisioning request try: sp_handler.user_provision(user=values.userid, swtoken=values.token) except Exception as e: sys.exit(e) securepass-tools-0.4.3/bin/sp-user-xattrs000077500000000000000000000052571257503017300204640ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Extended attributes operations ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys operations = ("list", "set", "delete") parser = ArgumentParser( description="Operate on users' extended attributes in SecurePass", prog="sp-user-xattrs", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('username', action='store') parser.add_argument('operation', action='store', choices=operations) parser.add_argument('attribute', nargs="?", default=None) parser.add_argument('value', nargs="?", default=None) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) username = values.username operation = values.operation op_attribute = values.attribute op_value = values.value ## If list operation specified if operation == "list": ## Display info try: attributes = sp_handler.users_xattr_list(user=username) print "Extended attributes details for %s" % username print "================================================\n" for attribute, value in attributes.items(): print "%s: %s" % (attribute, value) except Exception as e: sys.exit(e) elif operation == "set": # Set value if op_attribute is None or op_value is None: sys.exit( "Couldn't find either attribute or value: set " ) ## Set value try: sp_handler.users_xattr_set( user=username, attribute=op_attribute, value=op_value ) print "Attribute %s set for user %s" % (op_attribute, username) except Exception as e: sys.exit(e) elif operation == "delete": # Delete if op_attribute is None: sys.exit( "Couldn't find attribute: delete " ) try: ## Set value sp_handler.users_xattr_delete(user=username, attribute=op_attribute) print "Attribute %s deleted for user %s" % (op_attribute, username) except Exception as e: print e securepass-tools-0.4.3/bin/sp-users000077500000000000000000000043301257503017300173130ustar00rootroot00000000000000#!/usr/bin/python ## ## SecurePass CLI tools utilities ## Users list ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## from argparse import ArgumentParser from securepass import utils from securepass import securepass import logging import sys parser = ArgumentParser( description="List SecurePass users", prog="sp-users", ) parser.add_argument('-D', '--debug', action='store_true', dest="debug_flag", help="Enable debug output",) parser.add_argument('-d', '--details', action='store_true', dest="details_flag", help="Show details",) parser.add_argument('-H', '--noheaders', action='store_true', dest="noheader_flag", help="Don't print headers",) parser.add_argument('-r', '--realm', action='store', dest="realm", default=None, help="Set alternate realm",) values = parser.parse_args() ## Set debug FORMAT = '%(asctime)-15s %(levelname)s: %(message)s' if values.debug_flag: logging.basicConfig(format=FORMAT, level=logging.DEBUG) else: logging.basicConfig(format=FORMAT, level=logging.INFO) ## Load config config = utils.loadConfig() ## Config the handler sp_handler = securepass.SecurePass(app_id=config['app_id'], app_secret=config['app_secret'], endpoint=config['endpoint']) ## List all users if values.details_flag and not values.noheader_flag: print "%-35s %-35s %s" % ("User ID", "Name and Surname", "Status") print "================================================================================" try: for user in sp_handler.user_list(realm=values.realm): if values.details_flag: user_detail = sp_handler.user_info(user=user) fullname = "%s %s" % (user_detail['name'], user_detail['surname']) ## User status if user_detail['enabled']: status = "Active" else: status = 'Disabled' print "%-35s %-35s %s" % (user, fullname, status) else: print user except Exception as e: sys.exit(e) securepass-tools-0.4.3/contrib/000077500000000000000000000000001257503017300164745ustar00rootroot00000000000000securepass-tools-0.4.3/contrib/extract_ssh_key.sh000066400000000000000000000006411257503017300222300ustar00rootroot00000000000000#!/bin/sh ## ## Add SSH key from SecurePass ## get_ssh_key() { local user="$1" sshkey=$(sp-user-xattrs $user list|grep sshkey |cut -d: -f2) sshkey=${sshkey%%} echo $sshkey } if [ "x$1" == "x" ] then echo "Please specify the username" exit 1 fi KEY=$(get_ssh_key $1) rc=$(grep "$KEY" ~/.ssh/authorized_keys) if [ -z "$rc" ] then echo $KEY >> ~/.ssh/authorized_keys; echo "Key added" fi securepass-tools-0.4.3/python-securepass.spec000066400000000000000000000033031257503017300214030ustar00rootroot00000000000000Name: python-securepass Version: 0.4.3 Release: 1%{?dist} Summary: SecurePass Python tools Group: Development/Libraries License: GPLv2+ URL: https://github.com/garlsecurity/securepass-tools Source0: https://github.com/garlsecurity/securepass-tools/archive/v%{version}/securepass-tools-v%{version}.tar.gz BuildArch: noarch BuildRequires: python-pycurl BuildRequires: python-argparse BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root Requires: python-pycurl Requires: python-argparse %description The tools and python libraries for accessing SecurePass platform. It uses the SecurePass public APIs. %prep %setup -qn securepass-tools-%{version} %build %{__python} setup.py build %install [ "%{buildroot}" != "/" ] && rm -rf $RPM_BUILD_ROOT %{__python} setup.py install --skip-build --root="%{buildroot}" --prefix="%{_prefix}" %clean [ "%{buildroot}" != "/" ] && rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root,-) %{python_sitelib}/* %{_usr}/bin/* %doc README.txt README.md securepass.conf.example contrib/extract_ssh_key.sh %if 0%{?rhel} <= 6 %doc LICENSE %else %license LICENSE %endif %changelog * Sat Sep 12 2015 Alessio Treglia 0.4.3-1 - Drop optparse in favor of argparse - Fix broken import statement in the Django module * Fri Aug 28 2015 Giuseppe Paterno' 0.4.1-1 - Added SSH key helper * Tue Aug 25 2015 Giuseppe Paterno' 0.4-1 - Support for extended attributes in users and realms - Support for privacy bit in the APIs * Fri Nov 14 2014 Giuseppe Paterno' 0.3.6-1 - Initial RPM spec for securepass-tools securepass-tools-0.4.3/requirements.txt000066400000000000000000000000071257503017300203150ustar00rootroot00000000000000pycurl securepass-tools-0.4.3/securepass.conf.example000066400000000000000000000001041257503017300215050ustar00rootroot00000000000000[default] APP_ID = <> APP_SECRET = <> securepass-tools-0.4.3/securepass/000077500000000000000000000000001257503017300172115ustar00rootroot00000000000000securepass-tools-0.4.3/securepass/__init__.py000066400000000000000000000000001257503017300213100ustar00rootroot00000000000000securepass-tools-0.4.3/securepass/djangoauth.py000066400000000000000000000045161257503017300217150ustar00rootroot00000000000000# Django SecurePass APIs authentication backend # # This code is released under GPLv2 # # (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) # GARL Sagl (www.garl.ch) # from . import securepass from django.conf import settings from django.contrib.auth.models import User class SecurePassAuthBackend(object): """ SecurePass' core authentication backend Settings: SP_APP_ID -> SecurePass APP ID SP_APP_SECRET -> SecurePass APP Secret SP_ENDPOINT -> API endpoint SP_AUTOCREATE_USER -> True/False, set if you want automatic creation of user SP_REALM -> SecurePass realm """ # Actual auth def authenticate(self, username, password): endpoint = getattr( settings, 'SP_ENDPOINT', 'https://beta.secure-pass.net') autocreate = getattr(settings, 'SP_AUTOCREATE_USER', True) sp_handle = securepass.SecurePass( app_id=getattr(settings, 'SP_APP_ID', ''), app_secret=getattr(settings, 'SP_APP_SECRET', ''), endpoint=endpoint) # Add realm if '@' not in username: realm = getattr(settings, 'SP_REALM', 'login.farm') username = '{0}@{1}'.format(username, realm) if sp_handle.user_auth(user=username, secret=password): try: mapping = User.objects.get(username=username) except User.DoesNotExist: # user will have an "unusable" password if autocreate: mapping = User.objects.create_user(username, '') mapping.save() else: return None try: myuser = sp_handle.user_info(user=username) mapping.first_name = myuser['name'] mapping.last_name = myuser['surname'] mapping.is_active = myuser['enabled'] mapping.email = myuser['email'] mapping.save() except: return None return mapping else: return None def get_user(self, user_id): """Retrieve the user's entry in the User model if it exists""" try: return User.objects.get(pk=user_id) except User.DoesNotExist: return None securepass-tools-0.4.3/securepass/securepass.py000066400000000000000000000555101257503017300217460ustar00rootroot00000000000000## ## Generic SecurePass Class to access APIs of Dreamliner ## www.secure-pass.net ## ## This code is released under GPLv2 ## ## Contains some code from Ganeti project (c) Google Inc. ## Copyright (C) 2010, 2011, 2012 Google Inc ## ## This library is under development, please sync from: ## https://github.com/gpaterno/securepass-tools ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## import logging import pycurl import json import urllib from StringIO import StringIO HTTP_APP_JSON = "application/json" USER_AGENT = "SecurePass CLI" HTTP_GET = "GET" HTTP_PUT = "PUT" HTTP_POST = "POST" # Older pycURL versions don't have all error constants try: _CURLE_SSL_CACERT = pycurl.E_SSL_CACERT _CURLE_SSL_CACERT_BADFILE = pycurl.E_SSL_CACERT_BADFILE except AttributeError: _CURLE_SSL_CACERT = 60 _CURLE_SSL_CACERT_BADFILE = 77 _CURL_SSL_CERT_ERRORS = frozenset([ _CURLE_SSL_CACERT, _CURLE_SSL_CACERT_BADFILE, ]) class SecurePass(object): def __init__(self, app_id=None, app_secret=None, endpoint=None, logger=logging): """ Inizialize the class """ self.app_id = app_id self.app_secret = app_secret self._logger = logger if endpoint is not None: self.endpoint = endpoint else: self.endpoint = "https://beta.secure-pass.net/" def _SendRequest(self, method, path, content=None): """Sending CURL request Method is GET/POST Path is the subpath of the request Content is a dictionary """ assert path.startswith("/") curl = pycurl.Curl() # Default cURL settings curl.setopt(pycurl.VERBOSE, False) curl.setopt(pycurl.FOLLOWLOCATION, False) curl.setopt(pycurl.MAXREDIRS, 5) curl.setopt(pycurl.NOSIGNAL, True) curl.setopt(pycurl.USERAGENT, USER_AGENT) curl.setopt(pycurl.SSL_VERIFYHOST, 0) curl.setopt(pycurl.SSL_VERIFYPEER, False) curl.setopt(pycurl.HTTPHEADER, [ "Accept: %s" % HTTP_APP_JSON, "Content-type: %s" % HTTP_APP_JSON, "X-SecurePass-App-ID: %s" % self.app_id, "X-SecurePass-App-Secret: %s" % self.app_secret, ]) url = "%s%s" % (self.endpoint, path) self._logger.debug("Sending request %s %s (content=%r)", method, url, content) # Buffer for response encoded_resp_body = StringIO() # Configure cURL curl.setopt(pycurl.CUSTOMREQUEST, str(method)) curl.setopt(pycurl.URL, str(url)) curl.setopt(pycurl.WRITEFUNCTION, encoded_resp_body.write) if content is not None: curl.setopt(pycurl.POSTFIELDS, urllib.urlencode(content)) try: # Send request and wait for response try: curl.perform() except pycurl.error as err: if err.args[0] in _CURL_SSL_CERT_ERRORS: self._logger.error("SSL certificate error %s" % err, code=err.args[0]) finally: # Reset settings to not keep references to large objects in memory # between requests curl.setopt(pycurl.POSTFIELDS, "") curl.setopt(pycurl.WRITEFUNCTION, lambda _: None) # Was anything written to the response buffer? if encoded_resp_body.tell(): response_content = json.loads(encoded_resp_body.getvalue()) else: response_content = None return response_content ## ## SecurePass Utilities ## def ping(self): """ Ping the SecurePass server and get some information """ response = self._SendRequest(HTTP_GET, "/api/v1/ping") if response['rc'] == 0: return "Ping from IPv%s address %s" % (response['ip_version'], response['ip']) else: raise Exception(response['errorMsg']) def log(self, message=""): """ Log a message to the central logging facility """ request = {} request['MESSAGE'] = message response = self._SendRequest(HTTP_POST, "/api/v1/logs/log", content=request) if response['rc'] == 0: print "Log sent" else: print response['errorMsg'] def get_logs(self, realm=None, start=None, end=None): """ Get the list of logs """ request = {} if realm is not None: request['REALM'] = realm ## Start date if start is not None: request['START'] = start ## End date if end is not None: request['END'] = end response = self._SendRequest(HTTP_POST, "/api/v1/logs/get", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## ## SecurePass Application handling ## # List apps def app_list(self, realm=None): """ Get the list of applications in your realm """ request = {} tmpapp = [] if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/apps/list", content=request) if response['rc'] == 0: for app in response['APP_ID']: tmpapp.append(app) return tmpapp else: raise Exception(response['errorMsg']) # Application info def app_info(self, app_id=None): """ Get information about given application """ request = {} if app_id is not None: request['APP_ID'] = app_id response = self._SendRequest(HTTP_POST, "/api/v1/apps/info", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) # Create application def app_add(self, label="", allow_network_ipv4=None, allow_network_ipv6=None, write=False, privacy=False, group=None, realm=None): """ Add an application to SecurePass """ request = {} request['LABEL'] = label request['WRITE'] = write request['PRIVACY'] = privacy if allow_network_ipv4 is not None: request['ALLOW_NETWORK_IPv4'] = allow_network_ipv4 if allow_network_ipv6 is not None: request['ALLOW_NETWORK_IPv6'] = allow_network_ipv6 if group is not None: request['GROUP'] = group if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/apps/add", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) # Delete The application def app_delete(self, app_id=None): """ Delete an application """ request = {} if app_id is not None: request['APP_ID'] = app_id response = self._SendRequest(HTTP_POST, "/api/v1/apps/delete", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## Modify the application # Create application def app_modify(self, app_id=None, label=None, allow_network_ipv4=None, allow_network_ipv6=None, write=None, privacy=None, group=None, realm=None): """ Modify an application in SecurePass """ request = {} if app_id is not None: request['APP_ID'] = app_id if label is not None: request['LABEL'] = label if write is not None: request['WRITE'] = write if privacy is not None: request['PRIVACY'] = privacy if allow_network_ipv4 is not None: request['ALLOW_NETWORK_IPv4'] = allow_network_ipv4 if allow_network_ipv6 is not None: request['ALLOW_NETWORK_IPv6'] = allow_network_ipv6 if group is not None: request['GROUP'] = group if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/apps/modify", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## ## SecurePass Users handling ## # List users def user_list(self, realm=None): """ Get the list of applications in your realm """ request = {} tmpuser = [] if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/users/list", content=request) if response['rc'] == 0: for user in response['username']: tmpuser.append(user) return tmpuser else: raise Exception(response['errorMsg']) ## Get user info def user_info(self, user=None): """ Get the details of a user in your realm """ request = {} if user is not None: request['USERNAME'] = user response = self._SendRequest(HTTP_POST, "/api/v1/users/info", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## Authenticate user def user_auth(self, user=None, secret=None): """ Authenticate the user """ request = {} if user is not None: request['USERNAME'] = user if secret is not None: request['SECRET'] = secret response = self._SendRequest(HTTP_POST, "/api/v1/users/auth", content=request) if response['rc'] == 0: return response['authenticated'] else: raise Exception(response['errorMsg']) ## Add a user def user_add(self, user=None, name=None, surname=None, email=None, mobile=None, nin=None, rfid=None, manager=None): """ Add a user into the realm """ request = {} if user is not None: request['USERNAME'] = user if name is not None: request['NAME'] = name if surname is not None: request['SURNAME'] = surname if email is not None: request['EMAIL'] = email if mobile is not None: request['MOBILE'] = mobile if nin is not None: request['NIN'] = nin if rfid is not None: request['RFID'] = rfid if manager is not None: request['MANAGER'] = manager response = self._SendRequest(HTTP_POST, "/api/v1/users/add", content=request) if response['rc'] == 0: return response['username'] else: raise Exception(response['errorMsg']) ## Remove a user def user_del(self, user=None): """ Remove a user """ request = {} if user is not None: request['USERNAME'] = user response = self._SendRequest(HTTP_POST, "/api/v1/users/delete", content=request) if response['rc'] == 0: return True else: raise Exception(response['errorMsg']) ## Remove a user def user_provision(self, user=None, swtoken=None): """ Provision a user """ request = {} SWTOKENS = ('iphone', 'android', 'blackberry', 'software') if user is not None: request['USERNAME'] = user if swtoken is not None and swtoken.lower() in SWTOKENS: request['SWTOKEN'] = swtoken.lower() response = self._SendRequest(HTTP_POST, "/api/v1/users/token/provision", content=request) if response['rc'] == 0: return True else: raise Exception(response['errorMsg']) ## Change user password def user_password_change(self, user=None, password=None): """ Change user password """ request = {} if user is not None: request['USERNAME'] = user if password is not None: request['PASSWORD'] = password response = self._SendRequest(HTTP_POST, "/api/v1/users/password/change", content=request) if response['rc'] == 0: return True else: raise Exception(response['errorMsg']) ## Disable user password def user_password_disable(self, user=None): """ Disable password """ request = {} if user is not None: request['USERNAME'] = user response = self._SendRequest(HTTP_POST, "/api/v1/users/password/disable", content=request) if response['rc'] == 0: return True else: raise Exception(response['errorMsg']) ## Disable user def user_disable(self, user=None): """ Disable user """ request = {} if user is not None: request['USERNAME'] = user response = self._SendRequest(HTTP_POST, "/api/v1/users/disable", content=request) if response['rc'] == 0: return True else: raise Exception(response['errorMsg']) ## Enable user def user_enable(self, user=None): """ Enable a given user """ request = {} if user is not None: request['USERNAME'] = user response = self._SendRequest(HTTP_POST, "/api/v1/users/enable", content=request) if response['rc'] == 0: return True else: raise Exception(response['errorMsg']) ## ## SecurePass users' extended attributes (xattr) ## def users_xattr_list(self, user=None): """ Get Users' extended attributes """ request = {} if user is not None: request['USERNAME'] = user response = self._SendRequest(HTTP_POST, "/api/v1/users/xattrs/list", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) def users_xattr_set(self, user=None, attribute=None, value=None): """ Set Users' extended attributes """ request = {} if user is not None: request['USERNAME'] = user if attribute is not None: request['ATTRIBUTE'] = attribute if value is not None: request['VALUE'] = value response = self._SendRequest(HTTP_POST, "/api/v1/users/xattrs/set", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) def users_xattr_delete(self, user=None, attribute=None): """ Delete Users' extended attribute """ request = {} if user is not None: request['USERNAME'] = user if attribute is not None: request['ATTRIBUTE'] = attribute response = self._SendRequest(HTTP_POST, "/api/v1/users/xattrs/delete", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## ## SecurePass Realms extended attributes (xattr) ## def realms_xattr_list(self, realm=None): """ Get Users' extended attributes """ request = {} if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/realms/xattrs/list", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) def realms_xattr_set(self, realm=None, attribute=None, value=None): """ Set Users' extended attributes """ request = {} if realm is not None: request['REALM'] = realm if attribute is not None: request['ATTRIBUTE'] = attribute if value is not None: request['VALUE'] = value response = self._SendRequest(HTTP_POST, "/api/v1/realms/xattrs/set", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) def realms_xattr_delete(self, realm=None, attribute=None): """ Delete Users' extended attribute """ request = {} if realm is not None: request['REALM'] = realm if attribute is not None: request['ATTRIBUTE'] = attribute response = self._SendRequest(HTTP_POST, "/api/v1/realms/xattrs/delete", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## ## SecurePass Group handling ## def group_member(self, user=None, group=None): """ Check if user is member of a group """ request = {} if user is not None: request['USERNAME'] = user if group is not None: request['GROUP'] = group response = self._SendRequest(HTTP_POST, "/api/v1/groups/member", content=request) if response['rc'] == 0: return response['member'] else: raise Exception(response['errorMsg']) ## ## SecurePass RADIUS handling ## ## List the radiuses def radius_list(self, realm=None): """ Lists RADIUS devices in a realm """ request = {} tmpradius = [] if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/radius/list", content=request) if response['rc'] == 0: for radius in response['radius']: tmpradius.append(radius) return tmpradius else: raise Exception(response['errorMsg']) ## Radius info def radius_info(self, radius=None): """ Get the details of a RADIUS in your realm """ request = {} if radius is not None: request['RADIUS'] = radius response = self._SendRequest(HTTP_POST, "/api/v1/radius/info", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## Delete Radius def radius_del(self, radius=None): """ Remove a RADIUS device """ request = {} if radius is not None: request['RADIUS'] = radius response = self._SendRequest(HTTP_POST, "/api/v1/radius/delete", content=request) if response['rc'] == 0: return True else: raise Exception(response['errorMsg']) ## Modify a radius def radius_modify(self, radius=None, name=None, secret=None, rfid=None, group=None, realm=None): """ Modify a RADIUS device """ request = {} if radius is not None: request['RADIUS'] = radius if name is not None: request['NAME'] = name if secret is not None: request['SECRET'] = secret if rfid is not None: request['RFID'] = rfid if group is not None: request['GROUP'] = group if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/radius/modify", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## Add a radius def radius_add(self, radius=None, name=None, secret=None, rfid=None, group=None, realm=None): """ Add a RADIUS device """ request = {} if radius is not None: request['RADIUS'] = radius if name is not None: request['NAME'] = name if secret is not None: request['SECRET'] = secret if rfid is not None: request['RFID'] = rfid if group is not None: request['GROUP'] = group if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/radius/add", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) ## ## SecurePass Realm handling xattrs/global policies ## def realm_xattr_list(self, realm=None): """ Get Realm' extended attributes """ request = {} if realm is not None: request['REALM'] = realm response = self._SendRequest(HTTP_POST, "/api/v1/realms/xattrs/list", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) def realm_xattr_set(self, realm=None, attribute=None, value=None): """ Set Realm' extended attributes """ request = {} if realm is not None: request['REALM'] = realm if attribute is not None: request['ATTRIBUTE'] = attribute if value is not None: request['VALUE'] = value response = self._SendRequest(HTTP_POST, "/api/v1/realms/xattrs/set", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) def realm_xattr_delete(self, realm=None, attribute=None): """ Delete Realm' extended attribute """ request = {} if realm is not None: request['REALM'] = realm if attribute is not None: request['ATTRIBUTE'] = attribute response = self._SendRequest(HTTP_POST, "/api/v1/realms/xattrs/delete", content=request) if response['rc'] == 0: del response['rc'] del response['errorMsg'] return response else: raise Exception(response['errorMsg']) securepass-tools-0.4.3/securepass/utils.py000066400000000000000000000037201257503017300207250ustar00rootroot00000000000000## ## SecurePass CLI tools utilities ## ## This code is released under GPLv2 ## ## (c) 2013 Giuseppe Paterno' (gpaterno@gpaterno.com) ## GARL Sagl (www.garl.ch) ## import logging import ConfigParser import os import sys def loadConfig(): """loadConfig returns cassandra servers""" conffiles = ['/etc/securepass.conf', '/usr/local/etc/securepass.conf', os.getcwd() + '/securepass.conf'] #conffiles.append(os.path.join(os.path.expanduser("~"), ".securepass")) ## Virtual Environment handling # VIRTUAL_ENV is not reliable, switching to sys.real_prefix if hasattr(sys, 'real_prefix'): conffiles.append(sys.prefix + "/securepass.conf") conffiles.append(sys.prefix + "/etc/securepass.conf") conf_found = 0 ## Get Config File for conf in conffiles: if not os.path.isfile(conf): logging.debug("Unable to open config file %s!" % conf) else: logging.debug("Config file found at %s!" % conf) conf_found = 1 if conf_found == 0: logging.error("Unable to find configuration files") sys.exit(1) config = ConfigParser.ConfigParser() config.read(conffiles) ## Default config myconfig = {} myconfig['endpoint'] = "https://beta.secure-pass.net/" try: ## Get required configuration myconfig['app_id'] = config.get("default", "app_id") myconfig['app_secret'] = config.get("default", "app_secret") except: logging.debug("Unable to load config file") return {} ## Get endpoint, if specified try: myconfig['endpoint'] = config.get("default", "endpoint") except: pass # Get realm, if specified try: myconfig['realm'] = config.get("nss", "realm") except: pass # SSH behaviour try: myconfig['root'] = config.get("ssh", "root") except: pass # Return array with config return myconfigsecurepass-tools-0.4.3/setup.py000066400000000000000000000016701257503017300165520ustar00rootroot00000000000000try: from setuptools import setup except ImportError: from distutils.core import setup setup( name='securepass', version='0.4.3', author="Giuseppe Paterno'", author_email='gpaterno@gpaterno.com', packages=['securepass'], scripts=['bin/sp-app-add','bin/sp-group-member','bin/sp-radius-mod','bin/sp-user-passwd','bin/sp-app-del','bin/sp-radius-add','bin/sp-user-add','bin/sp-user-provision', 'bin/sp-app-info','bin/sp-radius-del','bin/sp-user-auth','bin/sp-user-xattrs', 'bin/sp-app-mod','bin/sp-radius-info','bin/sp-user-del','bin/sp-users','bin/sp-apps','bin/sp-radius-list','bin/sp-user-info', 'bin/sp-user-mod', 'bin/sp-logs', 'bin/sp-realm-xattrs', 'bin/sp-sshkey', 'bin/sp-config'], url='https://github.com/garlsecurity/securepass-tools', license='LICENSE.txt', description='SecurePass tools', long_description=open('README.txt').read(), install_requires=[ "pycurl >= 7.19.0", ], )