optools/sys/user_cull.py
2019-01-18 18:53:49 -05:00

126 lines
5.1 KiB
Python
Executable File

#!/usr/bin/env python3
# Because:
# - SSH timeout doesn't work with byobu/screen/tmux
# - SSH timeout can be overridden client-side
# - $TMOUT can be overridden user-side
# we need to actually kill the sshd process attached to the SSH session.
# This does have some limitations, though. Namely, it doesn't work for screen/tmux sessions.
# specifically if they happen to be using byobu with a status bar that updates, because that process
# gathering information for the status bar counts as "activity". Go figure.
import datetime
import os
import psutil
import subprocess
# in seconds. 5 minutes = 300 seconds.
# if "auto", we'll try checking $TMOUT in the system bashrc and sshd_config, in that order.
timeout = 'auto'
# only apply to ssh connections instead of ssh + local.
# THIS WILL KILL SCREEN/TMUX CONNECTIONS. USE WITH CAUTION.
only_ssh = True
# send a closing message.
goodbye = True
# the message to send to the user if goodbye == True.
# can use the following for substitution:
# pid - The PID if the user's login process.
# terminal - The terminal they're logged in on.
# loginlength - How long they've been logged in (in minutes).
# logintime - When they logged in.
# timeout - The allowed length of time for inactivity until a timeout.
goodbye_mesg = ('You have been logged in for {loginlength} (since {logintime}) on {terminal} ({pid}).\n'
'However, as per security policy, you have exceeded the allowed idle timeout ({timeout}).\n'
'As such, your session will now be terminated. Please feel free to reconnect.')
# exclude these usernames
exclude_users = []
# Get the SSHD PIDs.
ssh_pids = [p.pid for p in psutil.process_iter() if p.name() == 'sshd']
# If the timeout is set to auto, try to find it.
if timeout == 'auto':
import re
#tmout_re = re.compile('^\s*#*(export\s*)?TMOUT=([0-9]+).*$')
tmout_re = re.compile('^\s*(export\s*)?TMOUT=([0-9]+).*$')
# We don't bother with factoring in ClientAliveCountMax.
# sshd_re = re.compile('^\s*#*ClientAliveCountMax\s+([0-9+]).*$')
sshd_re = re.compile('^\s*ClientAliveInterval\s+([0-9+]).*$')
for f in ('/etc/bashrc', '/etc/bash.bashrc'):
if not os.path.isfile(f):
continue
with open(f, 'r') as fh:
conf = fh.read()
for line in conf.splitlines():
if tmout_re.search(line):
try:
timeout = int(tmout_re.sub('\g<2>', line))
break
except ValueError:
continue
if not isinstance(timeout, int): # keep going; check sshd_config
with open('/etc/ssh/sshd_config', 'r') as f:
conf = f.read()
for line in conf.splitlines():
if sshd_re.search(line):
try:
timeout = int(tmout_re.sub('\g<1>', line))
break
except ValueError:
continue
# Finally, set a default. 5 minutes is sensible.
timeout = 300
pretty_timeout = datetime.timedelta(seconds = timeout)
def get_idle(user):
idle_time = None
try:
# https://unix.stackexchange.com/a/332704/284004
last_used = datetime.datetime.fromtimestamp(os.stat('/dev/{0}'.format(user.terminal)).st_atime)
idle_time = datetime.datetime.utcnow() - last_used
except FileNotFoundError:
# It's probably a graphical login (e.g. gnome uses ::1) - you're on your own.
pass
return(idle_time)
for user in psutil.users():
if user.name in exclude_users:
continue
try:
login_pid = user.pid
except AttributeError:
continue # Doesn't have a PID
login_length = (datetime.datetime.utcnow() - datetime.datetime.fromtimestamp(user.started))
if login_length.total_seconds() < timeout:
continue # they haven't even been logged in for long enough yet.
idle_time = get_idle(user)
parent_pid = psutil.Process(user.pid).ppid()
try:
diff = idle_time.total_seconds() >= timeout
except AttributeError:
# Something went wrong when getting idle_time. probably a graphical desktop login.
diff = False
if diff:
fmt_vals = {'pid': user.pid,
'terminal': user.terminal,
'loginlength': login_length,
'logintime': datetime.datetime.fromtimestamp(user.started),
'timeout': pretty_timeout}
fmtd_goodbye = goodbye_mesg.format(**fmt_vals)
if only_ssh:
if parent_pid in ssh_pids:
if goodbye:
subprocess.run(['write',
user.name,
user.terminal],
input = fmtd_goodbye.encode('utf-8'))
psutil.Process(parent_pid).terminate()
else:
if goodbye:
subprocess.run(['write',
user.name,
user.terminal],
input = fmtd_goodbye.encode('utf-8'))
psutil.Process(parent_pid).terminate()