585 lines
20 KiB
PHP
585 lines
20 KiB
PHP
#!/usr/bin/php
|
|
<?php
|
|
|
|
chdir(__DIR__);
|
|
require('../core.php');
|
|
require('sync-common.php');
|
|
$required_files = array('config/keys-sync', 'config/keys-sync.pub');
|
|
foreach($required_files as $file) {
|
|
if(!file_exists($file)) die("Sync cannot start - $file not found.\n");
|
|
}
|
|
|
|
// Parse the command-line arguments
|
|
$options = getopt('h:i:au:p', array('help', 'host:', 'id:', 'all', 'user:', 'preview'));
|
|
if(isset($options['help'])) {
|
|
show_help();
|
|
exit(0);
|
|
}
|
|
$short_to_long = array(
|
|
'h' => 'host',
|
|
'i' => 'id',
|
|
'a' => 'all',
|
|
'u' => 'user',
|
|
'p' => 'preview'
|
|
);
|
|
foreach($short_to_long as $short => $long) {
|
|
if(isset($options[$short]) && isset($options[$long])) {
|
|
echo "Error: short form -$short and long form --$long both specified\n";
|
|
show_help();
|
|
exit(1);
|
|
}
|
|
if(isset($options[$short])) $options[$long] = $options[$short];
|
|
}
|
|
$hostopts = 0;
|
|
if(isset($options['host'])) $hostopts++;
|
|
if(isset($options['id'])) $hostopts++;
|
|
if(isset($options['all'])) $hostopts++;
|
|
if($hostopts != 1) {
|
|
echo "Error: must specify exactly one of --host, --id, or --all\n";
|
|
show_help();
|
|
exit(1);
|
|
}
|
|
if(isset($options['user'])) {
|
|
$username = $options['user'];
|
|
} else {
|
|
$username = null;
|
|
}
|
|
$preview = isset($options['preview']);
|
|
|
|
// Use 'keys-sync' user as the active user (create if it does not yet exist)
|
|
try {
|
|
$active_user = $user_dir->get_user_by_uid('keys-sync');
|
|
} catch(UserNotFoundException $e) {
|
|
$active_user = new User;
|
|
$active_user->uid = 'keys-sync';
|
|
$active_user->name = 'Synchronization script';
|
|
$active_user->email = '';
|
|
$active_user->active = 1;
|
|
$active_user->admin = 1;
|
|
$active_user->developer = 0;
|
|
$user_dir->add_user($active_user);
|
|
}
|
|
|
|
|
|
// Build list of servers to sync
|
|
if(isset($options['all'])) {
|
|
$servers = $server_dir->list_servers();
|
|
} elseif(isset($options['host'])) {
|
|
$servers = array();
|
|
$hostnames = explode(",", $options['host']);
|
|
foreach($hostnames as $hostname) {
|
|
$hostname = trim($hostname);
|
|
try {
|
|
$servers[] = $server_dir->get_server_by_hostname($hostname);
|
|
} catch(ServerNotFoundException $e) {
|
|
echo "Error: hostname '$hostname' not found\n";
|
|
exit(1);
|
|
}
|
|
}
|
|
} elseif(isset($options['id'])) {
|
|
sync_server($options['id'], $username, $preview);
|
|
exit(0);
|
|
}
|
|
|
|
$pending_syncs = array();
|
|
foreach($servers as $server) {
|
|
if($server->key_management != 'keys') {
|
|
continue;
|
|
}
|
|
$pending_syncs[$server->hostname] = $server;
|
|
}
|
|
|
|
$sync_procs = array();
|
|
define('MAX_PROCS', 20);
|
|
while(count($sync_procs) > 0 || count($pending_syncs) > 0) {
|
|
while(count($sync_procs) < MAX_PROCS && count($pending_syncs) > 0) {
|
|
$server = reset($pending_syncs);
|
|
$hostname = key($pending_syncs);
|
|
$args = array();
|
|
$args[] = '--id';
|
|
$args[] = $server->id;
|
|
if(!is_null($username)) {
|
|
$args[] = '--user';
|
|
$args[] = $username;
|
|
}
|
|
if($preview) {
|
|
$args[] = '--preview';
|
|
}
|
|
$sync_procs[] = new SyncProcess(__FILE__, $args);
|
|
unset($pending_syncs[$hostname]);
|
|
}
|
|
foreach($sync_procs as $ref => $sync_proc) {
|
|
$data = $sync_proc->get_data();
|
|
if(!empty($data)) {
|
|
echo $data['output'];
|
|
unset($sync_procs[$ref]);
|
|
}
|
|
}
|
|
usleep(200000);
|
|
}
|
|
|
|
function show_help() {
|
|
?>
|
|
Usage: sync.php [OPTIONS]
|
|
Syncs public keys to the specified hosts.
|
|
|
|
Mandatory arguments to long options are mandatory for short options too.
|
|
-a, --all sync with all active hosts in the database
|
|
-h, --host=HOSTNAME sync only the specified host(s)
|
|
(specified by name, comma-separated)
|
|
-i, --id=ID sync only the specified single host
|
|
(specified by id)
|
|
-u, --user sync only the specified user account
|
|
-p, --preview perform no changes, display content of all
|
|
keyfiles
|
|
--help display this help and exit
|
|
<?php
|
|
}
|
|
|
|
function sync_server($id, $only_username = null, $preview = false) {
|
|
global $config;
|
|
global $server_dir;
|
|
global $user_dir;
|
|
|
|
$keydir = '/var/local/keys-sync';
|
|
$header = "## Auto generated keys file for %s
|
|
## Do not edit this file! Modify at %s
|
|
";
|
|
$header_no_link = "## Auto generated keys file for %s
|
|
## Do not edit this file!
|
|
";
|
|
$liam_key = file_get_contents('config/keys-sync.pub');
|
|
|
|
$server = $server_dir->get_server_by_id($id);
|
|
$hostname = $server->hostname;
|
|
echo date('c')." {$hostname}: Preparing sync.\n";
|
|
$server->ip_address = gethostbyname($hostname);
|
|
$server->update();
|
|
if($server->key_management != 'keys') return;
|
|
$accounts = $server->list_accounts();
|
|
$keyfiles = array();
|
|
$sync_warning = false;
|
|
// Generate keyfiles for each account
|
|
foreach($accounts as $account) {
|
|
if($account->active == 0 || $account->sync_status == 'proposed') continue;
|
|
$username = str_replace('/', '', $account->name);
|
|
$keyfile = sprintf($header, "account '{$account->name}'", $config['web']['baseurl']."/servers/".urlencode($hostname)."/accounts/".urlencode($account->name));
|
|
// Collect a set of all groups that the account is a member of (directly or indirectly) and the account itself
|
|
$sets = $account->list_group_membership();
|
|
$sets[] = $account;
|
|
foreach($sets as $set) {
|
|
if(get_class($set) == 'Group') {
|
|
if($set->active == 0) continue; // Rules for inactive groups should be ignored
|
|
$keyfile .= "# === Start of rules applied due to membership in {$set->name} group ===\n";
|
|
}
|
|
$access_rules = $set->list_access();
|
|
$keyfile .= get_keys($access_rules, $account->name, $hostname);
|
|
if(get_class($set) == 'Group') {
|
|
$keyfile .= "# === End of rules applied due to membership in {$set->name} group ===\n\n";
|
|
}
|
|
}
|
|
$keyfiles[$username] = array('keyfile' => $keyfile, 'check' => false, 'account' => $account);
|
|
}
|
|
if($server->authorization == 'automatic LDAP' || $server->authorization == 'manual LDAP') {
|
|
// Generate keyfiles for LDAP users
|
|
$optiontext = array();
|
|
foreach($server->list_ldap_access_options() as $option) {
|
|
$optiontext[] = $option->option.(is_null($option->value) ? '' : '="'.str_replace('"', '\\"', $option->value).'"');
|
|
}
|
|
$prefix = implode(',', $optiontext);
|
|
if($prefix !== '') $prefix .= ' ';
|
|
$users = $user_dir->list_users();
|
|
foreach($users as $user) {
|
|
$username = str_replace('/', '', $user->uid);
|
|
if(is_null($only_username) || $username == $only_username) {
|
|
if(!isset($keyfiles[$username])) {
|
|
$keyfile = sprintf($header, "LDAP user '{$user->uid}'", $config['web']['baseurl']);
|
|
$keys = $user->list_public_keys($username, $hostname);
|
|
if(count($keys) > 0) {
|
|
if($user->active) {
|
|
foreach($keys as $key) {
|
|
$keyfile .= $prefix.$key->export()."\n";
|
|
}
|
|
} else {
|
|
$keyfile .= "# Inactive account\n";
|
|
}
|
|
$keyfiles[$username] = array('keyfile' => $keyfile, 'check' => ($server->authorization == 'manual LDAP'));
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
if(array_key_exists('keys-sync', $keyfiles)) {
|
|
// keys-sync account should never be synced
|
|
unset($keyfiles['keys-sync']);
|
|
}
|
|
if($preview) {
|
|
foreach($keyfiles as $username => $keyfile) {
|
|
echo date('c')." {$hostname}: account '$username':\n\n\033[1;34m{$keyfile['keyfile']}\033[0m\n\n";
|
|
}
|
|
return;
|
|
}
|
|
// IP address check
|
|
echo date('c')." {$hostname}: Checking IP address {$server->ip_address}:{$server->port}.\n";
|
|
$matching_servers = $server_dir->list_servers(array(), array('ip_address' => $server->ip_address, 'port' => $server->port, 'key_management' => array('keys')));
|
|
if(count($matching_servers) > 1) {
|
|
echo date('c')." {$hostname}: Multiple hosts with same IP address.\n";
|
|
$server->sync_report('sync failure', 'Multiple hosts with same IP address');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
return;
|
|
}
|
|
|
|
// This is working around deficiencies in the ssh2 library. In some cases, ssh connection attempts will fail, and
|
|
// the socket timeout of 60 seconds is somehow not triggered. Script execution timeout is also not triggered.
|
|
// Reproducing this problem is not easy - dropping packets to port 22 is not sufficient (it will timeout correctly).
|
|
// To workaround, we wrap calls to this script with 'timeout' shell command, and from this point on until we have
|
|
// established a connection, catch SIGTERM and report server sync failure if received
|
|
declare(ticks = 1);
|
|
pcntl_signal(SIGTERM, function($signal) use($server, $hostname, $keyfiles) {
|
|
echo date('c')." {$hostname}: SSH connection timed out.\n";
|
|
$server->sync_report('sync failure', 'SSH connection timed out');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
exit(1);
|
|
});
|
|
|
|
echo date('c')." {$hostname}: Attempting to connect.\n";
|
|
$legacy = false;
|
|
$attempts = array('keys-sync', 'root');
|
|
foreach($attempts as $attempt) {
|
|
try {
|
|
$connection = ssh2_connect($hostname, $server->port);
|
|
} catch(ErrorException $e) {
|
|
echo date('c')." {$hostname}: Failed to connect.\n";
|
|
$server->sync_report('sync failure', 'SSH connection failed');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
return;
|
|
}
|
|
$fingerprint = ssh2_fingerprint($connection, SSH2_FINGERPRINT_MD5 | SSH2_FINGERPRINT_HEX);
|
|
if(is_null($server->rsa_key_fingerprint)) {
|
|
$server->rsa_key_fingerprint = $fingerprint;
|
|
$server->update();
|
|
} else {
|
|
if(strcmp($server->rsa_key_fingerprint, $fingerprint) !== 0) {
|
|
echo date('c')." {$hostname}: RSA key validation failed.\n";
|
|
$server->sync_report('sync failure', 'SSH host key verification failed');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
return;
|
|
}
|
|
}
|
|
if(!isset($config['security']) || !isset($config['security']['host_key_collision_protection']) || $config['security']['host_key_collision_protection'] == 1) {
|
|
$matching_servers = $server_dir->list_servers(array(), array('rsa_key_fingerprint' => $server->rsa_key_fingerprint, 'key_management' => array('keys')));
|
|
if(count($matching_servers) > 1) {
|
|
echo date('c')." {$hostname}: Multiple hosts with same host key.\n";
|
|
$server->sync_report('sync failure', 'Multiple hosts with same host key');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
return;
|
|
}
|
|
}
|
|
try {
|
|
ssh2_auth_pubkey_file($connection, $attempt, 'config/keys-sync.pub', 'config/keys-sync');
|
|
echo date('c')." {$hostname}: Logged in as $attempt.\n";
|
|
break;
|
|
} catch(ErrorException $e) {
|
|
$legacy = true;
|
|
if($attempt == 'root') {
|
|
echo date('c')." {$hostname}: Public key authentication failed.\n";
|
|
$server->sync_report('sync failure', 'SSH authentication failed');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
try {
|
|
$sftp = ssh2_sftp($connection);
|
|
} catch(ErrorException $e) {
|
|
echo date('c')." {$hostname}: SFTP subsystem setup failed.\n";
|
|
$server->sync_report('sync failure', 'SFTP subsystem failed');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
return;
|
|
}
|
|
try {
|
|
$dir = ssh2_sftp_stat($sftp, $keydir);
|
|
} catch(ErrorException $e) {
|
|
echo date('c')." {$hostname}: Key directory does not exist.\n";
|
|
$dir = null;
|
|
$sync_warning = 'Key directory does not exist';
|
|
}
|
|
if($legacy && !$sync_warning) {
|
|
$sync_warning = 'Using legacy sync method';
|
|
}
|
|
|
|
// From this point on, catch SIGTERM and ignore. SIGINT or SIGKILL is required to stop, so timeout wrapper won't
|
|
// cause a partial sync
|
|
pcntl_signal(SIGTERM, SIG_IGN);
|
|
|
|
$account_errors = 0;
|
|
$cleanup_errors = 0;
|
|
|
|
if(isset($config['security']) && isset($config['security']['hostname_verification']) && $config['security']['hostname_verification'] >= 1) {
|
|
// Verify that we have mutual agreement with the server that we sync to it with this hostname
|
|
$allowed_hostnames = null;
|
|
if($config['security']['hostname_verification'] >= 2) {
|
|
// 2+ = Compare with /var/local/keys-sync/.hostnames
|
|
try {
|
|
$allowed_hostnames = array_map('trim', file("ssh2.sftp://$sftp/var/local/keys-sync/.hostnames"));
|
|
} catch(ErrorException $e) {
|
|
if($config['security']['hostname_verification'] >= 3) {
|
|
// 3+ = Abort if file does not exist
|
|
echo date('c')." {$hostname}: Hostnames file missing.\n";
|
|
$server->sync_report('sync failure', 'Hostnames file missing');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
return;
|
|
} else {
|
|
$allowed_hostnames = null;
|
|
}
|
|
}
|
|
}
|
|
if(is_null($allowed_hostnames)) {
|
|
$stream = ssh2_exec($connection, '/bin/hostname -f');
|
|
stream_set_blocking($stream, true);
|
|
$allowed_hostnames = array(trim(stream_get_contents($stream)));
|
|
fclose($stream);
|
|
}
|
|
if(!in_array($hostname, $allowed_hostnames)) {
|
|
echo date('c')." {$hostname}: Hostname check failed (allowed: ".implode(", ", $allowed_hostnames).").\n";
|
|
$server->sync_report('sync failure', 'Hostname check failed');
|
|
$server->delete_all_sync_requests();
|
|
report_all_accounts_failed($keyfiles);
|
|
return;
|
|
}
|
|
}
|
|
|
|
if($legacy && isset($keyfiles['root'])) {
|
|
// Legacy sync (only if using root account)
|
|
$keyfile = $keyfiles['root'];
|
|
try {
|
|
$local_filename = tempnam('/tmp', 'syncfile');
|
|
$fh = fopen($local_filename, 'w');
|
|
fwrite($fh, $keyfile['keyfile']."# LIAM system key\n".$liam_key);
|
|
fclose($fh);
|
|
ssh2_scp_send($connection, $local_filename, '/root/.ssh/authorized_keys2', 0600);
|
|
unlink($local_filename);
|
|
if(isset($keyfile['account'])) {
|
|
$keyfile['account']->sync_report('sync success');
|
|
}
|
|
} catch(ErrorException $e) {
|
|
echo date('c')." {$hostname}: Sync command execution failed for legacy root.\n";
|
|
$account_errors++;
|
|
if(isset($keyfile['account'])) {
|
|
$keyfile['account']->sync_report('sync failure');
|
|
}
|
|
}
|
|
}
|
|
|
|
// New sync
|
|
if($dir) {
|
|
$stream = ssh2_exec($connection, '/usr/bin/sha1sum '.escapeshellarg($keydir).'/*');
|
|
stream_set_blocking($stream, true);
|
|
$entries = explode("\n", stream_get_contents($stream));
|
|
$sha1sums = array();
|
|
foreach($entries as $entry) {
|
|
if(preg_match('|^([0-9a-f]{40}) '.preg_quote($keydir, '|').'/(.*)$|', $entry, $matches)) {
|
|
$sha1sums[$matches[2]] = $matches[1];
|
|
}
|
|
}
|
|
fclose($stream);
|
|
foreach($keyfiles as $username => $keyfile) {
|
|
if(is_null($only_username) || $username == $only_username) {
|
|
try {
|
|
$remote_filename = "$keydir/$username";
|
|
$remote_entity = "ssh2.sftp://" . intval($sftp) . $remote_filename;
|
|
$create = true;
|
|
if($keyfile['check']) {
|
|
$stream = ssh2_exec($connection, 'id '.escapeshellarg($username));
|
|
stream_set_blocking($stream, 1);
|
|
$output = stream_get_contents($stream);
|
|
fclose($stream);
|
|
if(empty($output)) $create = false;
|
|
}
|
|
if($create) {
|
|
if(isset($sha1sums[$username]) && $sha1sums[$username] == sha1($keyfile['keyfile'])) {
|
|
echo date('c')." {$hostname}: No changes required for {$username}\n";
|
|
} else {
|
|
file_put_contents($remote_entity, $keyfile['keyfile']);
|
|
ssh2_exec($connection, 'chown keys-sync: '.escapeshellarg($remote_filename));
|
|
echo date('c')." {$hostname}: Updated {$username}\n";
|
|
}
|
|
if(isset($sha1sums[$username])) {
|
|
unset($sha1sums[$username]);
|
|
}
|
|
} else {
|
|
ssh2_sftp_unlink($sftp, $remote_filename);
|
|
}
|
|
if(isset($keyfile['account'])) {
|
|
if($sync_warning && $username != 'root') {
|
|
// File was synced, but will not work due to configuration on server
|
|
$keyfile['account']->sync_report('sync warning');
|
|
} else {
|
|
$keyfile['account']->sync_report('sync success');
|
|
}
|
|
}
|
|
} catch(ErrorException $e) {
|
|
$account_errors++;
|
|
echo "{$hostname}: Sync command execution failed for $username, ".$e->getMessage()."\n";
|
|
if(isset($keyfile['account'])) {
|
|
$keyfile['account']->sync_report('sync failure');
|
|
}
|
|
}
|
|
}
|
|
}
|
|
if(is_null($only_username)) {
|
|
// Clean up directory
|
|
foreach($sha1sums as $file => $sha1sum) {
|
|
if($file != '' && $file != 'keys-sync' && $file != '.hostnames') {
|
|
try {
|
|
if(ssh2_sftp_unlink($sftp, "$keydir/$file")) {
|
|
echo date('c')." {$hostname}: Removed unknown file: {$file}\n";
|
|
} else {
|
|
$cleanup_errors++;
|
|
echo date('c')." {$hostname}: Couldn't remove unknown file: {$file}\n";
|
|
}
|
|
} catch(ErrorException $e) {
|
|
$cleanup_errors++;
|
|
echo date('c')." {$hostname}: Couldn't remove unknown file: {$file}, ".$e->getMessage().".\n";
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
try {
|
|
$uuid = trim(file_get_contents("ssh2.sftp://$sftp/etc/uuid"));
|
|
$server->uuid = $uuid;
|
|
$server->update();
|
|
} catch(ErrorException $e) {
|
|
// If the /etc/uuid file does not exist, silently ignore
|
|
}
|
|
if($cleanup_errors > 0) {
|
|
$server->sync_report('sync failure', 'Failed to clean up '.$cleanup_errors.' file'.($cleanup_errors == 1 ? '' : 's'));
|
|
} elseif($account_errors > 0) {
|
|
$server->sync_report('sync failure', $account_errors.' account'.($account_errors == 1 ? '' : 's').' failed to sync');
|
|
} elseif($sync_warning) {
|
|
$server->sync_report('sync warning', $sync_warning);
|
|
} else {
|
|
$server->sync_report('sync success', 'Synced successfully');
|
|
}
|
|
echo date('c')." {$hostname}: Sync finished\n";
|
|
}
|
|
|
|
function get_keys($access_rules, $account_name, $hostname) {
|
|
$keyfile = '';
|
|
foreach($access_rules as $access) {
|
|
$grant_date = new DateTime($access->grant_date);
|
|
$grant_date_full = $grant_date->format('c');
|
|
$entity = $access->source_entity;
|
|
$optiontext = array();
|
|
foreach($access->list_options() as $option) {
|
|
$optiontext[] = $option->option.(is_null($option->value) ? '' : '="'.str_replace('"', '\\"', $option->value).'"');
|
|
}
|
|
$prefix = implode(',', $optiontext);
|
|
if($prefix !== '') $prefix .= ' ';
|
|
switch(get_class($entity)) {
|
|
case 'User':
|
|
$keyfile .= "# {$entity->uid}";
|
|
$keyfile .= " granted access by {$access->granted_by->uid} on {$grant_date_full}";
|
|
$keyfile .= "\n";
|
|
if($entity->active) {
|
|
$keys = $entity->list_public_keys($account_name, $hostname);
|
|
foreach($keys as $key) {
|
|
$keyfile .= $prefix.$key->export()."\n";
|
|
}
|
|
} else {
|
|
$keyfile .= "# Inactive account\n";
|
|
}
|
|
break;
|
|
case 'ServerAccount':
|
|
$keyfile .= "# {$entity->name}@{$entity->server->hostname}";
|
|
$keyfile .= " granted access by {$access->granted_by->uid} on {$grant_date_full}";
|
|
$keyfile .= "\n";
|
|
if($entity->server->key_management != 'decommissioned') {
|
|
$keys = $entity->list_public_keys($account_name, $hostname);
|
|
foreach($keys as $key) {
|
|
$keyfile .= $prefix.$key->export()."\n";
|
|
}
|
|
} else {
|
|
$keyfile .= "# Decommissioned server\n";
|
|
}
|
|
break;
|
|
case 'Group':
|
|
// Recurse!
|
|
$seen = array($entity->name => true);
|
|
$keyfile .= "# {$entity->name} group";
|
|
$keyfile .= " granted access by {$access->granted_by->uid} on {$grant_date_full}";
|
|
$keyfile .= "\n";
|
|
if($entity->active) {
|
|
$keyfile .= "# == Start of {$entity->name} group members ==\n";
|
|
$keyfile .= get_group_keys($entity->list_members(), $account_name, $hostname, $prefix, $seen);
|
|
$keyfile .= "# == End of {$entity->name} group members ==\n";
|
|
} else {
|
|
$keyfile .= "# Inactive group\n";
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
return $keyfile;
|
|
}
|
|
|
|
function get_group_keys($entities, $account_name, $hostname, $prefix, &$seen) {
|
|
$keyfile = '';
|
|
foreach($entities as $entity) {
|
|
switch(get_class($entity)) {
|
|
case 'User':
|
|
$keyfile .= "# {$entity->uid}";
|
|
$keyfile .= "\n";
|
|
if($entity->active) {
|
|
$keys = $entity->list_public_keys($account_name, $hostname);
|
|
foreach($keys as $key) {
|
|
$keyfile .= $prefix.$key->export()."\n";
|
|
}
|
|
} else {
|
|
$keyfile .= "# Inactive account\n";
|
|
}
|
|
break;
|
|
case 'ServerAccount':
|
|
$keyfile .= "# {$entity->name}@{$entity->server->hostname}";
|
|
$keyfile .= "\n";
|
|
if($entity->server->key_management != 'decommissioned') {
|
|
$keys = $entity->list_public_keys($account_name, $hostname);
|
|
foreach($keys as $key) {
|
|
$keyfile .= $prefix.$key->export()."\n";
|
|
}
|
|
} else {
|
|
$keyfile .= "# Decommissioned server\n";
|
|
}
|
|
break;
|
|
case 'Group':
|
|
// Recurse!
|
|
if(!isset($seen[$entity->name])) {
|
|
$seen[$entity->name] = true;
|
|
$keyfile .= "# {$entity->name} group";
|
|
$keyfile .= "\n";
|
|
$keyfile .= "# == Start of {$entity->name} group members ==\n";
|
|
$keyfile .= get_group_keys($entity->list_members(), $account_name, $hostname, $prefix, $seen);
|
|
$keyfile .= "# == End of {$entity->name} group members ==\n";
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
return $keyfile;
|
|
}
|
|
|
|
function report_all_accounts_failed($keyfiles) {
|
|
foreach($keyfiles as $keyfile) {
|
|
if(isset($keyfile['account'])) {
|
|
$keyfile['account']->sync_report('sync failure');
|
|
}
|
|
}
|
|
}
|