optools/mumble/usermgmt.py

453 lines
22 KiB
Python
Executable File

#!/usr/bin/env python3
import argparse
import getpass
import hashlib
import os
import pprint
import sqlite3
import subprocess
import sys
class Manager(object):
def __init__(self, args):
self.args = args
self.conn = self.connect()
self.conn.row_factory = sqlite3.Row
if 'interactive' not in self.args.keys():
self.args['interactive'] = False
# Key mappings/types in user_info table; thanks to DireFog in Mumble's IRC channel for help with this.
# src/murmur/ServerDB.h, enum UserInfo
# 0 = User_Name
# 1 = User_Email
# 2 = User_Comment
# 3 = User_Hash
# 4 = User_Password
# 5 = User_LastActive
# 6 = User_KDFIterations
self.infomap = {0: 'name',
1: 'email',
2: 'comment',
3: 'certhash',
4: 'password',
5: 'last_active',
6: 'kdf_iterations'}
def connect(self):
if not os.path.isfile(self.args['database']):
raise FileNotFoundError('{0} does not exist! Check your path or create the initial databse by running murmurd.')
conn = sqlite3.connect(self.args['database'])
return(conn)
def add(self):
# SQLDO("INSERT INTO `%1users`... in src/murmur/ServerDB.cpp
if not (self.args['certhash'] or self.args['password']):
raise RuntimeError('You must specify either a certificate hash or a method for getting the password.')
if self.args['certhash']: # it's a certificate fingerprint hash
_e = '{0} is not a valid certificate fingerprint hash.'.format(self.args['certhash'])
try:
# Try *really hard* to mahe sure it's a SHA1.
# SHA1s are 160 bits in length, in hex (the string representations are
# 40 chars). However, we use 162 because of the prefix python3 adds
# automatically: "0b".
h = int(self.args['certhash'], 16)
try:
assert len(bin(h)) == 162
except AssertionError:
raise ValueError(_e)
except (ValueError, TypeError):
raise ValueError(_e)
if self.args['password']: # it's a password
if self.args['password'] == 'stdin':
self.args['password'] = hashlib.sha1(sys.stdin.read().replace('\n', '').encode('utf-8')).hexdigest().lower()
else:
_repeat = True
while _repeat == True:
_pass_in = getpass.getpass('What password should {0} have (will not echo back)? ')
if not _pass_in or _pass_in == '':
print('Invalid password. Please re-enter: ')
else:
self.args['password'] = hashlib.sha1(_pass_in.replace('\n', '').encode('utf-8')).hexdigest().lower()
# Insert into the "users" table
# I spit on the Mumble developers for not using https://sqlite.org/autoinc.html.
# Warning: this is kind of dangerous, as you can hit a race condition here.
_cur = self.conn.cursor()
_cur.execute("SELECT user_id FROM users WHERE server_id = '{0}'".format(self.args['server']))
_used_ids = [i[0] for i in _cur.fetchall()]
_used_ids2 = [x for x in range(_used_ids[0], _used_ids[-1] + 1)]
_avail_uids = list(set(_used_ids) ^ set(_used_ids2))
_qinsert = {}
_qinsert['lastchannel'] = '0'
_qinsert['last_active'] = None # Change this to '' if it complains
_qinsert['texture'] = None # Change this to '' if it complains
_qinsert['uid'] = _avail_uids[0]
for k in ('username', 'server', 'password'):
_qinsert[k] = self.args[k]
for k in _qinsert.keys():
if not _qinsert[k]:
_qinsert[k] = ''
_q = ("INSERT INTO users (server_id, user_id, name, pw, lastchannel, texture, last_active) " +
"VALUES ('{server}', '{uid}', '{username}', '{password}', '{lastchannel}', '{texture}'," +
"'{last_active}')").format(**_qinsert)
_cur.execute(_q)
self.conn.commit()
# Insert into the "user_info" table
for c in ('name', 'email', 'certhash', 'comment'):
if self.args[c]:
_qinsert = {}
_qinsert['server'] = self.args['server']
_qinsert['user_id'] = _avail_uids[0]
_qinsert['keyid'] = list(self.infomap.keys())[list(self.infomap.values()).index(c)]
_qinsert['value'] = self.args[c]
_q = ("INSERT INTO user_info (server_id, user_id, key, value) " +
"VALUES ('{server}', '{user_id}', '{keyid}', '{value}')".format(**_qinsert))
_cur.execute(_q)
self.conn.commit()
_cur.close()
# Insert into the "group_members" table if we need to
if self.args['groups']:
# The groups table, thankfully, has autoincrement.
for g in self.args['groups']:
_ginfo = {}
_minsert = {'server': self.args['server'],
'uid': _avail_uids[0],
'addit': 1}
_ginsert = {'server': self.args['server'],
'name': g,
'chan_id': 0,
'inherit': 1,
'inheritable': 1}
_create = True
_cur = self.conn.cursor()
_q = "SELECT * FROM groups WHERE server_id = '{0}'".format(self.args['server'])
_cur.execute(_q)
for r in _cur.fetchall():
if r['name'] == g:
_create = False
_ginfo = r
break
if not _ginfo:
create = True # Just in case...
if _create:
_q = ("INSERT INTO groups (server_id, name, channel_id, inherit, inheritable) " +
"VALUES ('{server}', '{name}', '{chan_id}', '{inherit}', '{inheritable}')").format(**_ginsert)
_cur.execute(_q)
self.conn.commit()
_lastins = _cur.lastrowid
_q = ("SELECT * FROM groups WHERE group_id = '{0}' AND server_id = '{1}'").format(_lastins,
self.args['server'])
_cur.execute(_q)
_ginfo = _cur.fetchone()
_minsert['gid'] = _ginfo['group_id']
_q = ("INSERT INTO group_members (group_id, server_id, user_id, addit) " +
"VALUES ('{gid}', '{server}', '{uid}', '{addit}')").format(**_minsert)
_cur.execute(_q)
self.conn.commit()
_cur.close()
return()
def rm(self):
_cur = self.conn.cursor()
# First we'll need the user's UID.
_q = "SELECT user_id FROM users WHERE server_id = '{0}' AND name = '{1}'".format(self.args['server'],
self.args['username'])
_cur.execute(_q)
_uid = _cur.fetchone()[0]
# Then we get the groups the user's in; we'll need these in a bit.
_q = "SELECT group_id FROM group_members WHERE server_id = '{0}' AND user_id = '{0}'".format(self.args['server'],
_uid)
_cur.execute(_q)
_groups = [g[0] for g in _cur.fetchall()]
# Okay, now we can delete the user and their metadata...
_qtmpl = "DELETE FROM {0} WHERE server_id = '{1}' AND user_id = '{2}'"
for t in ('users', 'group_members'):
_q = _qtmpl.format(t, self.args['server'], _uid)
_cur.execute(_q)
self.conn.commit()
if not self.args['noprune']:
for t in ('user_info', 'acl'):
_q = _qtmpl.format(t, self.args['server'], _uid)
_cur.execute(_q)
self.conn.commit()
# Now some groups maintenance.
if self.args['prunegrps']:
for gid in _groups:
_q = ("SELECT COUNT(*) FROM group_members WHERE " +
"server_id = '{0}' AND group_id = '{1}'").format(self.args['server'],
gid)
_cur.execute(_q)
if _cur.fetchone()[0] == 0:
_q = ("DELETE FROM group_members WHERE " +
"server_id = '{0}' AND group_id = '{1}'").format(self.args['server'],
gid)
_cur.execute(_q)
self.conn.commit()
_cur.close()
return()
def lsUsers(self):
users = {}
_fields = ('server_id', 'user_id', 'name', 'pw', 'lastchannel', 'texture', 'last_active')
if self.args['server']:
try:
self.args['server'] = int(self.args['server'])
_q = "SELECT * FROM users WHERE server_id = '{0}'".format(self.args['server'])
except (ValueError, TypeError):
pass # It's set as None, which we'll parse to mean as "all" per the --help output.
else:
_q = 'SELECT * FROM users'
_cur = self.conn.cursor()
_cur.execute(_q)
for r in _cur.fetchall():
_usr = r['user_id']
users[_usr] = {}
for f in _fields:
if f != 'user_id': # We set the dict key as this
users[_usr][f] = r[f]
_q = "SELECT * FROM user_info WHERE server_id = '{0}' AND user_id = '{1}'".format(r['server_id'],
r['user_id'])
_cur2 = self.conn.cursor()
_cur2.execute(_q)
for r2 in _cur2.fetchall():
if r2['key'] in self.infomap.keys():
users[_usr][self.infomap[r2['key']]] = r2['value']
_cur2.close()
for k in self.infomap.keys():
if self.infomap[k] not in users[_usr].keys():
users[_usr][self.infomap[k]] = None
if users[_usr]['comment']:
users[_usr]['comment'] = ('(truncated)' if len(users[_usr]['comment']) >= 32 else users[_usr]['comment'])
_cur.close()
#pprint.pprint(users)
# Now we print (or just return) the results. Whew.
if not self.args['interactive']:
return(users)
print_tmpl = ('{0:6}\t{1:3}\t{2:12} {3:24} {4:40} {5:40} {6:12} ' +
'{7:19} {8:32}')
print(print_tmpl.format('Server','UID','Username','Email',
'Password', 'Certhash', 'Last Channel',
'Last Active', 'Comment'), end = '\n\n')
for uid in users.keys():
d = users[uid]
print(print_tmpl.format(int(d['server_id']),
int(uid),
str(d['name']),
str(d['email']),
str(d['pw']),
str(d['certhash']),
(str(d['lastchannel']) if not d['lastchannel'] else int(d['lastchannel'])),
str(d['last_active']),
str(d['comment'])))
return()
def lsGroups(self):
groups = {}
_cur = self.conn.cursor()
# First, we get the groups.
if self.args['server']:
_q = "SELECT * FROM groups WHERE server_id = '{0}'".format(self.args['server'])
else:
_q = "SELECT * FROM groups"
_cur.execute(_q)
for r in _cur.fetchall():
_gid = r['group_id']
groups[_gid] = {'server': r['server_id'],
'name': r['name'],
'chan_id': r['channel_id'],
'inherit': r['inherit'],
'inheritable': r['inheritable']}
groups[_gid]['members'] = {}
_cur2 = self.conn.cursor()
_q2 = "SELECT * FROM group_members WHERE group_id = '{0}' AND server_id = '{1}'".format(_gid,
groups[_gid]['server'])
_cur2.execute(_q2)
for r2 in _cur2.fetchall():
# True means they are a member of the group. False means they are excluded from the group.
# (Helps override default policies?)
groups[_gid]['members'][r2['user_id']] = (True if r2['addit'] else False)
_cur2.close()
_cur.close()
# Return if we're non-interactive...
if not self.args['interactive']:
return(groups)
# Print the groups
print('GROUPS:')
print_tmpl = ('{0:3}\t{1:16}\t{2:10}\t{3:35}\t{4:30}')
print(print_tmpl.format('GID', 'Name', 'Channel ID',
'Inherit Parent Channel Permissions?', 'Allow Sub-channels to Inherit?'), end = '\n\n')
for g in groups.keys():
d = groups[g]
print(print_tmpl.format(g,
d['name'],
d['chan_id'],
str(True if d['inherit'] == 1 else False),
str(True if d['inheritable'] == 1 else False)))
print('\n\nMEMBERSHIPS:')
# And print the members
print_tmpl = ('\t\t{0:3}\t{1:>19}') # UID, Include or Exclude?
for g in groups.keys():
d = groups[g]
print('{0} ({1}):'.format(d['name'], g))
if d['members']:
print(print_tmpl.format('UID', 'Include or Exclude?'), end = '\n\n')
for m in d['members'].keys():
print(print_tmpl.format(m, ('Include' if d['members'][m] == 1 else 'Exclude')))
else:
print('\t\tNo members found; group is empty.')
return()
def edit(self):
print('Editing is not currently supported.')
return()
def close(self):
self.conn.close()
if self.args['operation'] in ('add', 'rm', 'edit'):
_cmd = ['systemctl', 'restart', 'murmur']
subprocess.run(_cmd)
return()
def parseArgs():
_db = '/var/lib/murmur/murmur.sqlite'
commonargs = argparse.ArgumentParser(add_help = False)
reqcommon = commonargs.add_argument_group('REQUIRED common arguments')
reqcommon.add_argument('-u',
'--user',
type = str,
dest = 'username',
required = True,
help = 'The username to perform the action for.')
reqcommon.add_argument('-s',
'--server',
type = int,
dest = 'server',
default = 1,
help = 'The server ID. Defaults to \033[1m{0}\033[0m'.format(1))
commonargs.add_argument('-d',
'--database',
type = str,
dest = 'database',
metavar = '/path/to/murmur.sqlite3',
default = _db,
help = 'The path to the sqlite3 database for Murmur. Default: \033[1m{0}\033[0m'.format(_db))
args = argparse.ArgumentParser(epilog = 'This program has context-sensitive help (e.g. try "... add --help")')
subparsers = args.add_subparsers(help = 'Operation to perform',
dest = 'operation')
addargs = subparsers.add_parser('add',
parents = [commonargs],
help = 'Add a user to the Murmur database')
delargs = subparsers.add_parser('rm',
parents = [commonargs],
help = 'Remove a user from the Murmur database')
listargs = subparsers.add_parser('ls',
help = 'List users in the Murmur database')
editargs = subparsers.add_parser('edit',
parents = [commonargs],
help = 'Edit a user in the Murmur database')
# Operation-specific optional arguments
addargs.add_argument('-n',
'--name',
type = str,
metavar = '"Firstname Lastname"',
dest = 'name',
default = None,
help = 'The new user\'s (real) name')
addargs.add_argument('-c',
'--comment',
type = str,
metavar = '"This comment becomes the user\'s profile."',
dest = 'comment',
default = None,
help = 'The comment for the new user')
addargs.add_argument('-e',
'--email',
type = str,
metavar = 'email@domain.tld',
dest = 'email',
default = None,
help = 'The email address for the new user')
addargs.add_argument('-C',
'--certhash',
type = str,
metavar = 'CERTIFICATE_FINGERPRINT_HASH',
default = None,
dest = 'certhash',
help = ('The certificate fingerprint hash. See genfprhash.py. ' +
'If you do not specify this, you must specify -p/--passwordhash'))
addargs.add_argument('-p',
'--passwordhash',
type = str,
dest = 'password',
choices = ['stdin', 'prompt'],
default = None,
help = ('If not specified, you must specify -C/--certhash. Otherwise, either ' +
'\'stdin\' (the password is being piped into this program) or \'prompt\' ' +
'(a password will be asked for in a non-echoing prompt). "prompt" is much more secure and recommended.'))
addargs.add_argument('-g',
'--groups',
type = str,
metavar = 'GROUP1(,GROUP2,GROUP3...)',
default = None,
help = ('A comma-separated list of groups the user should be added to. If a group ' +
'doesn\'t exist, it will be created'))
# Listing should only take the DB as the "common" arg
listargs.add_argument('-g',
'--groups',
action = 'store_true',
dest = 'groups',
help = 'If specified, list groups (and their members), not users')
listargs.add_argument('-s',
'--server',
type = str,
dest = 'server',
default = None,
help = 'The server ID. Defaults to all servers. Specify one by the numerical ID.')
listargs.add_argument('-d',
'--database',
type = str,
dest = 'database',
metavar = '/path/to/murmur.sqlite3',
default = _db,
help = 'The path to the sqlite3 database for Murmur. Default: \033[1m{0}\033[0m'.format(_db))
# Deleting args
delargs.add_argument('-n',
'--no-prune',
dest = 'noprune',
action = 'store_true',
help = ('If specified, do NOT remove the ACLs and user info for the user as well (profile, ' +
'certificate fingerprint, etc.)'))
delargs.add_argument('-P',
'--prune-groups',
dest = 'prunegrps',
action = 'store_true',
help = 'If specified, remove any groups the user was in that are now empty (i.e. the user was the only member)')
return(args)
def main():
args = vars(parseArgs().parse_args())
if not args['operation']:
#raise RuntimeError('You must specify an operation to perform. Try running with -h/--help.')
exit('You must specify an operation to perform. Try running with -h/--help.')
args['interactive'] = True
#pprint.pprint(args)
mgmt = Manager(args)
if args['operation'] == 'add':
if args['groups']:
mgmt.args['groups'] = [g.strip() for g in args['groups'].split(',')]
mgmt.add()
elif args['operation'] == 'rm':
mgmt.rm()
elif args['operation'] == 'ls':
if not args['groups']:
mgmt.lsUsers()
else:
mgmt.lsGroups()
elif args['operation'] == 'edit':
mgmt.edit()
else:
pass # No-op because something went SUPER wrong.
mgmt.close()
if __name__ == '__main__':
main()