summaryrefslogtreecommitdiffstats
path: root/ipa-python/ipautil.py
diff options
context:
space:
mode:
authorSimo Sorce <ssorce@redhat.com>2008-08-07 16:14:37 -0400
committerSimo Sorce <ssorce@redhat.com>2008-08-11 18:30:50 -0400
commit5cbc453d89af0ef79b7c99849778f1982abeda05 (patch)
tree9384cf201866d68d39e2382618c49c2290f6abf2 /ipa-python/ipautil.py
parent599fe1a0f5c046da6f99448ac43599b2681069d5 (diff)
downloadfreeipa-5cbc453d89af0ef79b7c99849778f1982abeda05.tar.gz
freeipa-5cbc453d89af0ef79b7c99849778f1982abeda05.tar.xz
freeipa-5cbc453d89af0ef79b7c99849778f1982abeda05.zip
Add encrypt_file and decrypt_file utility functions.
We will use them to encrypt the replica file so that we can transport it over more safely. It contains sensitive data, by encrypting it we assure that even if a distracted admin leaves it around it cannot be accessed without knowing the access passphrase (usually the Directory Manager password) Along the way fix also ipautil.run which was buggy and not passing in correctly stdin. Add dependency for gnupg in spec file
Diffstat (limited to 'ipa-python/ipautil.py')
-rw-r--r--ipa-python/ipautil.py65
1 files changed, 64 insertions, 1 deletions
diff --git a/ipa-python/ipautil.py b/ipa-python/ipautil.py
index 117171c4c..649a3f203 100644
--- a/ipa-python/ipautil.py
+++ b/ipa-python/ipautil.py
@@ -73,11 +73,13 @@ def write_tmp_file(txt):
return fd
def run(args, stdin=None):
- p = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
if stdin:
+ p = subprocess.Popen(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
stdout,stderr = p.communicate(stdin)
else:
+ p = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
stdout,stderr = p.communicate()
+
logging.info(stdout)
logging.info(stderr)
@@ -115,6 +117,67 @@ def backup_file(fname):
if file_exists(fname):
os.rename(fname, fname + ".orig")
+# uses gpg to compress and encrypt a file
+def encrypt_file(source, dest, password, workdir = None):
+ if type(source) is not StringType or not len(source):
+ raise ValueError('Missing Source File')
+ #stat it so that we get back an exception if it does no t exist
+ os.stat(source)
+
+ if type(dest) is not StringType or not len(dest):
+ raise ValueError('Missing Destination File')
+
+ if type(password) is not StringType or not len(password):
+ raise ValueError('Missing Password')
+
+ #create a tempdir so that we can clean up with easily
+ tempdir = tempfile.mkdtemp('', 'ipa-', workdir)
+ gpgdir = tempdir+"/.gnupg"
+
+ try:
+ try:
+ #give gpg a fake dir so that we can leater remove all
+ #the cruft when we clean up the tempdir
+ os.mkdir(gpgdir)
+ args = ['/usr/bin/gpg', '--homedir', gpgdir, '--passphrase-fd', '0', '--yes', '--no-tty', '-o', dest, '-c', source]
+ run(args, password)
+ except:
+ raise
+ finally:
+ #job done, clean up
+ shutil.rmtree(tempdir, ignore_errors=True)
+
+
+def decrypt_file(source, dest, password, workdir = None):
+ if type(source) is not StringType or not len(source):
+ raise ValueError('Missing Source File')
+ #stat it so that we get back an exception if it does no t exist
+ os.stat(source)
+
+ if type(dest) is not StringType or not len(dest):
+ raise ValueError('Missing Destination File')
+
+ if type(password) is not StringType or not len(password):
+ raise ValueError('Missing Password')
+
+ #create a tempdir so that we can clean up with easily
+ tempdir = tempfile.mkdtemp('', 'ipa-', workdir)
+ gpgdir = tempdir+"/.gnupg"
+
+ try:
+ try:
+ #give gpg a fake dir so that we can leater remove all
+ #the cruft when we clean up the tempdir
+ os.mkdir(gpgdir)
+ args = ['/usr/bin/gpg', '--homedir', gpgdir, '--passphrase-fd', '0', '--yes', '--no-tty', '-o', dest, '-d', source]
+ run(args, password)
+ except:
+ raise
+ finally:
+ #job done, clean up
+ shutil.rmtree(tempdir, ignore_errors=True)
+
+
class CIDict(dict):
"""
Case-insensitive but case-respecting dictionary.