diff options
Diffstat (limited to 'ipa-admintools/ipa-pwpolicy')
| -rw-r--r-- | ipa-admintools/ipa-pwpolicy | 153 |
1 files changed, 153 insertions, 0 deletions
diff --git a/ipa-admintools/ipa-pwpolicy b/ipa-admintools/ipa-pwpolicy new file mode 100644 index 00000000..91b0f3ec --- /dev/null +++ b/ipa-admintools/ipa-pwpolicy @@ -0,0 +1,153 @@ +#! /usr/bin/python -E +# Authors: Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2007 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +import sys +try: + from optparse import OptionParser + import ipa + import ipa.entity + import ipa.ipaclient as ipaclient + import ipa.config + + import xmlrpclib + import kerberos + import errno + import validate + import socket +except ImportError: + print >> sys.stderr, """\ +There was a problem importing one of the required Python modules. The +error was: + + %s +""" % sys.exc_value + sys.exit(1) + +def parse_options(): + usage = "ipa-pwpolicy [--maxlife days] [--minlife hours] [--history number] [--minclasses number] [--minlength number] [-v|--verbose]\n" + usage += "ipa-pwpolicy --show" + parser = OptionParser(usage=usage, formatter=ipa.config.IPAFormatter()) + parser.add_option("--maxlife", dest="maxlife", + help="Max. Password Lifetime (days)") + parser.add_option("--minlife", dest="minlife", + help="Min. Password Lifetime (hours)") + parser.add_option("--history", dest="history", + help="Password History Size") + parser.add_option("--minclasses", dest="minclasses", + help="Min. Number of Character Classes") + parser.add_option("--minlength", dest="minlength", + help="Min. Length of Password") + parser.add_option("--show", dest="show", action="store_true", + help="Show the current password policy") + parser.add_option("--usage", action="store_true", + help="Program usage") + parser.add_option("-v", "--verbose", action="store_true", dest="verbose", + help="Verbose output of the XML-RPC connection") + + ipa.config.add_standard_options(parser) + options, args = parser.parse_args() + + if not options.show: + if not options.maxlife and not options.minlife and not options.history and not options.minclasses and not options.minlength: + parser.error("need at least one option of --maxlife, --minlife, --history, --minclasses or --minlength") + + ipa.config.init_config(options) + + return options, args + +def show_policy(client): + policy = client.get_password_policy() + print "Password Policy" + print "Min. Password Lifetime (hours): %s" % policy.getValues('krbminpwdlife') + print "Max. Password Lifetime (days): %s" % policy.getValues('krbmaxpwdlife') + print "Min. Number of Character Classes: %s" % policy.getValues('krbpwdmindiffchars') + print "Min. Length of Password: %s" % policy.getValues('krbpwdminlength') + print "Password History Size: %s" % policy.getValues('krbpwdhistorylength') + +def update_policy(client, options): + current = client.get_password_policy() + + new = ipa.entity.Entity(current.toDict()) + + try: + if options.maxlife: + validate.is_integer(options.maxlife, min=0) + new.setValue('krbmaxpwdlife', options.maxlife) + if options.minlife: + validate.is_integer(options.minlife, min=0) + new.setValue('krbminpwdlife', options.minlife) + if options.history: + validate.is_integer(options.history, min=0) + new.setValue('krbpwdhistorylength', options.history) + if options.minclasses: + validate.is_integer(options.minclasses, min=0) + new.setValue('krbpwdmindiffchars', options.minclasses) + if options.minlength: + validate.is_integer(options.minlength, min=0) + new.setValue('krbpwdminlength', options.minlength) + except (validate.VdtTypeError, validate.VdtValueTooSmallError), e: + print e + return 1 + + if int(new.getValue('krbminpwdlife')) > int(new.getValue('krbmaxpwdlife')) * 24: + print "Maximum password life must be greater than minimum" + return 1 + + client.update_password_policy(new) + return 0 + +def main(): + options, args = parse_options() + + client = ipaclient.IPAClient(verbose=options.verbose) + + if options.show: + show_policy(client) + return 0 + + return update_policy(client, options) + +try: + if __name__ == "__main__": + sys.exit(main()) +except SystemExit, e: + sys.exit(e) +except KeyboardInterrupt, e: + sys.exit(1) +except xmlrpclib.Fault, fault: + if fault.faultCode == errno.ECONNREFUSED: + print "The IPA XML-RPC service is not responding." + else: + print fault.faultString + sys.exit(1) +except kerberos.GSSError, e: + print "Could not initialize GSSAPI: %s/%s" % (e[0][0], e[0][1]) + sys.exit(1) +except xmlrpclib.ProtocolError, e: + print "Unable to connect to IPA server: %s" % (e.errmsg) + sys.exit(1) +except ipa.ipaerror.IPAError, e: + print "%s" % (e.message) + sys.exit(1) +except socket.error, e: + print e[1] + print "Re-run with -v flag for more details." +except Exception, e: + print "%s" % str(e) + sys.exit(1) |