Your IP : 172.28.240.42
WLc @ s d Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l Z d Z d Z d d d g Z e j d k r e j Z n d
Z e d Z d Z d
Z d e Z d Z d Z d e j e f d YZ d f d YZ d e f d YZ d Z! d Z" e# d k re" n d S( s' lshell restricts a user's shell environment to limited sets of commands
lshell is a shell coded in Python that lets you restrict a user's environment
to limited sets of commands, choose to enable/disable any command over SSH
(e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing
iN( t getpasst getusers3 Ignace Mouzannar (ghantoos) <ghantoos@ghantoos.org>s 0.9.14t allowedt forbiddent warning_counters /usrt s /etc/lshell.confs .lhistorys .lshell_locks Usage: lshell [OPTIONS]
--config <file> : Config file location (default %s)
--log <dir> : Log files directory
-h, --help : Show this help message
--version : Show version
s- Limited Shell (lshell) limited help.
Cheers.
sR You are in a limited shell.
Type '?' or 'help' to get the list of allowed commandst ShellCmdc B s e Z d Z d d d d d d Z d Z d Z d Z d Z d Z d Z
d d d Z d d Z d d d
Z
d Z d d Z d
Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z RS( s Main lshell CLI class
c C s | d k r t j | _ n | | _ | d k r? t j | _ n | | _ | d k rc t j | _ n | | _ | | _ | j d | _ | j d d k r | j | j d n | j d | _ | j j d t
j j | | j j
d rA| j d | _ | j j d t | _ | j j d t j d | _ n t | _ d
| j | _ | j d | _ | | _ | | _ d S( Nt logpatht timeri s +./-s Logged int prompts %us %hi s %s:~$ t intro( t Nonet syst stdint stdoutt stderrt conft logt mytimert
identcharst errort cmdt Cmdt __init__t has_keyt
promptbaset replaceR t ost unameR R
t g_cmdt g_line( t selft userconfR
R R R R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR Y s2 % c C sh | j d k rQ | j j d | j d k rA | j j d n t j d n | j | j | j d d k r t
j | | S| j | j d k r t
j | | S| j | j d k rt
j d
d | j d | j | _ t
j d
d | j d | j | _ t | j d t k rEt | j | j d | _ n | j j d | j | j d k rx| j q;| j d k r| j q;| j d k r| j q;| j d k r| j q;| j d k r| j q;t j | j n@ | j d k r;| j j d | j | j j d | j n d d d | _ | _ | _ t
j | | S( s This method actually takes care of all the called method that are not resolved (i.e not existing methods). It actually will simulate the existance of any method entered in the 'allowed' variable list.
e.g. You just have to add 'uname' in list of allowed commands in the 'allowed' variable, and lshell will react as if you had added a do_uname in the ShellCmd class!
t quitt exitt EOFt Exiteds
i t stricti R s ^~$|^~/s %s/t home_paths ~/s %s/t aliasess CMD: "%s"t cdt lpatht lsudot historyt exportR t ?t helps INFO: unknown syntax -> "%s"s *** unknown syntax: %s
( s quits exitR# N( R R- s helpN( R R R R t writeR R" t check_secureR R t objectt __getattribute__t
check_patht ret subt g_argt typet dictt get_aliasest infoR( R) R* R+ R, R t systemR t warnR ( R t attr( ( s& /usr/lib/pymodules/python2.7/lshell.pyt __getattr__ sB "
c C s | j d d rj t j j d xF | j d d j d D]' } | r< t j j d | d q< q< Wn | j d d r t j j d xF | j d d j d D]' } | r t j j d | d q q Wn d S(
s* lists allowed and forbidden path
t pathi s Allowed:
t |s %s
ii s Denied:
N( R R R R/ t split( R R? ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR) s !"!c C sU | j j d rQ t j j d x, | j d D] } t j j d | q0 Wn d S( s% lists allowed sudo commands
t
sudo_commandss Allowed sudo commands:
s - %s
N( R R R R R/ ( R t command( ( s& /usr/lib/pymodules/python2.7/lshell.pyR* s c C s y y t j | j d Wn, t k
rI | j j d | j d n Xt | j d d } d } x8 | j D]* } t j j
d | | f | d 7} qs WWn | j j d n Xd S( s$ print the commands history
t history_files( WARN: couldn't write history to file %s
t ri s %d: %ss# ** Unable to read the history file.N( t readlinet write_history_fileR t IOErrorR R t opent readlinesR R R/ t critical( R t ft it item( ( s& /usr/lib/pymodules/python2.7/lshell.pyR+ s
c C s | j j d r | j j d d d } | j d r | j d d j d d d !\ } } t j j i | | 6 q n d S( s export environment variables t i t =i i N( R t countRA R t environt update( R t envt vart value( ( s& /usr/lib/pymodules/python2.7/lshell.pyR, s
)c C s t | j d k r y3 t j t j j | j | j t j Wq t k
r \ } } t j
j d | j | f q Xn' t j | j d | j t j d S( s, implementation of the "cd" command
i s lshell: %s: %s
R& N(
t lenR6 R t chdirR? t realpatht updatepromptt getcwdt OSErrorR R R/ R ( R t ErrorNumbert ErrorMessage( ( s& /usr/lib/pymodules/python2.7/lshell.pyR( s $c C s x | j d D]t } | d k r\ t j d | | | f | r | sU | j d n d Sq | | k r | s~ | j d n d Sq Wd } t j d | } xQ | D]I } | | j | d d
!j 7} | | j | d j d d 7} q Wt j d | } x4 | D], } | | j | d d
!j d d 7} q Wt j d
| } x> | D]6 } t j d | d } | | j | d d
7} qTW| d k rd S| j d s| j d rd St j d | } t j d d | } x.| D]&}
|
j j d } | d } t
| d k r.| }
n d }
| d k r|
d | j d k r|
r| j d d k r| s| j d qn | j j
d | d Sn | r| j d | j d <n | | j d k r| r| r| s| j d | qn | j j
d | d SqWd S( s This method is used to check the content on the typed command. Its purpose is to forbid the user to user to override the lshell command restrictions.
The forbidden characters are placed in the 'forbidden' variable.
Feel free to update the list. Emptying it would be quite useless..: )
A warining counter has been added, to kick out of lshell a user if he is warned more than X time (X beeing the 'warning_counter' variable).
R t &R@ s [^\%s]\%s[^\%s]t syntaxi i s \$\([^)]+[)]i iR% s
\`[^`]+[`]s \$\{[^}]+[}]s
=|\+|\?|\-s $(t `s &|\||;s \)$R RO t sudoRB RC s *** forbidden sudo -> %st oversshR s *** unknown command: %s( R_ R@ N( R R4 t findallt counter_updateR3 t stripR0 RA t
startswithR5 RW R R RK ( R t lineR% t sshRN t
returncodet
executionst curlyt variablet linest sperate_linet splitcmdRC t cmdargs( ( s& /usr/lib/pymodules/python2.7/lshell.pyR0 sf
'
*
c C s | r | } n | j } | j d d k rH | j j d | | f n | j d c d 8<| j d d k r | j j d | | f | j j d t j d nE | j j d | | f | j j d | j d | j j d d S(
sK Update the warning_counter, log and display a warning to the user
R is *** forbidden %s -> "%s"i i s *** Kicked outs< *** You have %s warning(s) left, before getting kicked out.
s! This incident has been reported.
N( R R R RK R R" R R/ ( R t messagetypeR? Rh ( ( s& /usr/lib/pymodules/python2.7/lshell.pyRe B s" c
C sY t | j d d } t | j d d d } | j j } x| D]} y t | } Wn n Xt | d k r t | } n t j j | } t j
d | r;t j d d | } t j
d
| d t d t j d
t j } | j | j } } | j d j d d j } t j j | } n t j j | }
t j j |
r||
d d k r||
d 7}
n t j
| |
} | rt j
| |
} n d } | s| rK | s| s| j d |
qn d SqK W| sUt j
| t j d sU| sN| j d t j t j | j d | j t j n d Sn d S( s Check if a path is entered in the line. If so, it checks if user are allowed to see this path. If user is not allowed, it calls self.counter_update. I case of completion, it only returns 0 or 1.
R? i i it strt ints \$|\*|\?s "|'R s `which echo` %st shellR
R RO t /R& ( s strs intN( Rs R Rf RA t evalR7 R R? t
expanduserR4 Rd R5 t
subprocesst Popent Truet PIPER
R RJ t
expandvarsRY t isdirR Re R[ RX RZ (
R Rh t
completionRi t allowed_path_ret denied_path_reRN t pt cint coutt tomatcht
match_allowedt match_denied( ( s& /usr/lib/pymodules/python2.7/lshell.pyR3 ] sP
#"
c C s | | j d k r& d | j | _ n\ t j | j d | rl d | j | j | j d d f | _ n d | j | f | _ d S( s/ Update prompt when changing directory
R& s %s:~$ s %s:~%s$ i s %s:%s$ N( R R R R4 Rd RA ( R R? ( ( s& /usr/lib/pymodules/python2.7/lshell.pyRZ s $c
C s | j | j r | j r y, t j | j d t j | j d WnW t k
r y2 t | j d d j t j | j d Wq t k
r q Xn Xt j
| _ t j | j
t j | j d n ze| d k r | | _ n | j d r$| j j t | j d d n d } x| s1| j rQ| j j d } n | j ry t | j } Wqt k
rd } qt k
r| j j d d } qXnN | j j | j | j j | j j } t | sd } n
| d
} | j | } | j | } | j | | } q-W| j Wd | j r}| j r}y t j | j Wq}t! k
ryq}Xn y t j" | j d Wn, t k
r| j# j$ d | j d n XXd S(
s Repeatedly issue a prompt, accept input, parse an initial prefix off the received input, and dispatch to action methods, passing them the remainder of the line as argument.
RD t history_sizet ws
: completeR
s
i R# R iNs( WARN: couldn't write history to file %s
(% t preloopt use_rawinputt completekeyRF t read_history_fileR t set_history_lengthRH RI t closet
get_completert
old_completert
set_completert completet parse_and_bindR R
R R/ Rs t cmdqueuet popt raw_inputR t EOFErrort KeyboardInterruptt flushR
RW t precmdt onecmdt postcmdt postloopt ImportErrorRG R R ( R R
t stopRh ( ( s& /usr/lib/pymodules/python2.7/lshell.pyt cmdloop sf
$
c C s | d k rt j } | j } t j d | d j } t | t | } t j | } t j | } | j d d d k r t | j d d k r | j } n t | j d d k r | j d d | j d k r | j
} n| | d k rp| j | \ } }
} | d k r9| j } qyy t
| d
| } Wqyt k
rl| j } qyXn | j } | | | | | | _ n y | j | SWn t k
rd SXd S( s Return the next possible completion for 'text'.
If a command has not been entered, then complete against command list.
Otherwise try to call complete_<command> to get list of completions.
i s &|\||;iRO Rb i i R R t complete_N( RF t get_line_buffert lstripR4 RA RW t
get_begidxt
get_endidxt completesudoR t
completechdirt parselinet completedefaultt getattrt AttributeErrort
completenamest completion_matchest
IndexErrorR ( R t textt statet origlineRh t strippedt begidxt endidxt compfuncR t argst foo( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s4 4
c C s | j j d d S( s+ This method overrides the original default method.
It was originally used to warn when an unknown command was entered (e.g. *** Unknown syntax: blabla).
It has been implemented in the __getattr__ method.
So it has no use here. Its output is now empty.
R N( R R/ ( R Rh ( ( s& /usr/lib/pymodules/python2.7/lshell.pyt default s c G si d | } | j } x& | j d D] } | j d | q$ Wg | D] } | j | rF | d ^ qF S( s This method overrides the original completenames method to overload it's output with the command available in the 'allowed' variable This is useful when typing 'tab-tab' in the command prompt
t do_R i ( t get_namesR t appendRg ( R R t ignoredt dotextt namesRC t a( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s
c C s- g | j d D] } | j | r | ^ q S( s complete sudo command RB ( R Rg ( R R Rh R R R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s c
C s g } | j d } t j d | j d | } y t j j | } Wn t j } n Xt j j | s | j d d d } | d k r d } n t j j | s t j } q n | j
| d d k rx t j | D]| } t j j t j j | | r| d } n
| d } | j
d rV| j
d rc| j | qcq | j | q Wg | D] } | j
| rn| ^ qnSd
Sd
S( s complete directories is ^~R& Rv i i R RO t .N( RA R4 R5 R R R? RY R[ R~ t rsplitR3 t listdirt joinRg R R (
R R Rh R R t toreturnt
tocompletet directoryt instanceR ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR # s2 !
&c C s | j | \ } } } | | | | _ | _ | _ | sE | j S| d k r^ | j | S| | _ | d k r | j | Sy t | d | } Wn t k
r | j | SX| | Sd S( s This method overrides the original onecomd method, to put the cmd, arg and line variables in class global variables: self.g_cmd, self.g_arg and self.g_line.
Thos variables are then used by the __getattr__ method
R R N(
R R R6 R t emptylineR R t lastcmdR R ( R Rh R t argt func( ( s& /usr/lib/pymodules/python2.7/lshell.pyR B s
c C s | j r
d Sd S( s This method overrides the original emptyline method, so it doesn't repeat the last command if last command was empty.
I just found this annoying..
i N( R ( R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR X s c C s | r y t | d | } Wn t k
r y> t | d | j } | rj | j j d t | d SWn t k
r~ n X| j j d t | j | f d SX| n5 t j | j d j
} | j | j | d S( sK This method overrides the original do_help method.
Instead of printing out the that are documented or not, it returns the list of allowed commands when '?' or 'help' is entered.
Of course, it doesn't override the help function: any help_* method will be called (e.g. help_help(self) )
t help_R s %s
NR (
R R t __doc__R R/ Rs t nohelpR8 t fromkeysR t keyst sortt columnize( R R R t doct list_tmp( ( s& /usr/lib/pymodules/python2.7/lshell.pyt do_help` s"
$
c C s | j j t d S( s Print Help on Help N( R R/ t help_help( R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR { s c C s. t j t j | j t j | j d d S( s This function is kicks you out the the lshell after the 'timer' variable exprires. 'timer' is set in seconds.
R N( t signalt SIGALRMt _timererrort alarmR ( R t timeout( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s c C s
t d d S( Ns lshell timer timeout( t
LshellTimeOut( R t signumt frame( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s N( t __name__t
__module__R R R R> R) R* R+ R, R( R0 Re R3 RZ R R R R R R R R R R R R ( ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR U s2 % 0
U ? @ # t CheckConfigc B s e Z d Z d d d d Z d Z d Z d Z d Z d Z d Z
d Z d Z d
Z
d Z d Z d
d Z d Z d Z d d Z d Z d
d
d Z d Z d Z RS( s# Check the configuration file.
c C s | d k r t j | _ n | | _ | d k r? t j | _ n | | _ | d k rc t j | _ n | | _ i | _ | j | | j \ | _ | _ | j | j d | j | j
| j | j | j
| j | j | j d S( s0 Force the calling of the methods below
t
configfileN( R R R
R R R t
getoptionst argumentst
check_filet
get_globalt check_logt
get_configt check_user_integrityt get_config_usert check_envt check_scp_sftpt check_passwd( R R R
R R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s( !
c C s t | d <y+ t j | d d d d d g \ } } Wn. t j k
re | j j d | j n Xx | D] \ } } | d k r t j j | | d <n | d k r t j j | | d
<n | d k r | | d <n | d k r | j n | d k rm | j qm qm Wd | d g } | j
d
rH| d | d
g 7} n t | t j d <t j j
d rt j d | d <n | | f S( s This method checks the usage. lshell.py must be called with a configuration file.
If no configuration file is specified, it will set the configuration file path to /etc/lshell.confelf.conf['allowed'].append('exit')
R s hc:s config=s log=R. t versions Missing or unknown argument(s)
s --configs --logR s -cRi s -hs --helps --versiont LSHELL_ARGSt SSH_ORIGINAL_COMMAND( s --config( s --log( s -c( s -hs --help( s --version(
t config_filet getoptt GetoptErrorR R/ t usageR R? RY R R Rs RR ( R R R t optlistR t optionRV ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s4
c C s! t j j t t j d d S( s Prints the usage i N( R R R/ R R" ( R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s c C s% t j j d t t j d d S( s Prints the version s lshell-%s - Limited Shell
i N( R R R/ t __version__R" ( R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s c C sT | j j d rP | j d } x. | j D] } t | | t j | <q, Wn d S( s5 Load environment variable set in configuration file t env_varsN( R R R Rs R RR ( R R t key( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s
c C sU t j j | sB | j j d | j j t t j d n t j | _ d S( sh This method checks the existence of the "argumently" given configuration file.
s! Error: Config file doesn't exist
i N(
R R? t existsR R/ R R R" t ConfigParsert config( R t file( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s
c C s y | j j | j d Wn@ t j t j f k
r] } | j j d | t j d n X| j j
d s | j j d t j d n xH | j j d D]4 } | j j | d s | d | j | d <q q Wd S( sD Loads the [global] parameters from the configuration file
R s ERR: %s
i t globals% Config file missing [global] section
i N(
R t readR R t MissingSectionHeaderErrort ParsingErrorR R/ R R" t has_sectiont itemsR ( R t argumentRN ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s c C s i t j d 6t j d 6t j d 6t j d 6| _ | j j d rt y t | j d } Wqz | j d } qz Xn d } t j | } t j
d t } t j
d | t j
t f } | j t j t j } | j | | j t j
d | j t j | j j d
s5d | j d
<n y t | j d
| j d
<Wn t k
rsd | j d
<n X| j d
d k rd | j d
<n# | j d
d k rd | j d
<n | j j d ry t | j d } Wn | j d } n Xt j } | j d
d | d } | j d d | d } | j d d | d } | j d d | d | d f } | j d t } n t } | j d
d k ry | d k rd d l m } | d d } | j | | j | j | j d
| j | n t j j | j d | d }
t |
d j } t j |
| _ | j j | | j j | j | j d
| j | j Wqt k
rqXn | | j d <| | _ d S( s* Sets the log level and log file
i i i i t
syslognamet lshells %%(asctime)s (%s): %%(message)ss %s[%s]: %s: %%(message)ss %(message)st logleveli t logfilenames %ys %ss %ms %02ds %ds %hs %02d%02ds %ut syslogi( t
SysLogHandlert addresss /dev/logR s .logR N(! t loggingt CRITICALt ERRORt WARNINGt DEBUGt levelsR R Rw t getLoggert FormatterR R t getpidt setLevelt
StreamHandlert
addHandlert setFormatterRt t
ValueErrort timet localtimeR t logging.handlersR R? R RI R t FileHandlert logfileRH R ( R t lognameR t loggert formattert syslogformattert logsterrt
currentimeR R
R t fp( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s|
c C s | j j | j d t | _ i | _ | j d t j } | j x8 | D]0 } t
j | d } d | } | j | qV W| j | j d S( s Load default, group and user configuation. Then merge them all.
The loadpriority is done in the following order:
1- User section
2- Group section
3- Default section
R R i s grp:N( R R R R t usert conf_rawt get_config_subR t getgroupst reverset grpt getgrgid( R t grplistt gidt grpnamet section( ( s& /usr/lib/pymodules/python2.7/lshell.pyR \ s
c C s | j j | r|xg| j j | D]P} | d } | d } t j d | j d d } t | d k r| d k rx| D]"} | j d
s | j d r | j j | j
| j | | q | d k r | j j i | j | 6 q | rl| d k rld d g } x4 t | D]& } | d c t
j j | d
7<q"W| j j i t | | 6 q | r t t | t k r | j j i | | 6 q q Wq% | d k r| d d k r| j j i | j | 6 q% | d k r\d d g } x: | j | d D]& } | d c t
j j | d
7<qW| j j i t | | 6 q% | j j t | g q% Wn d S( s[ this function is used to interpret the configuration +/-,
'all' etc.
i i s ([\+\-\s]+\[[^\]]+\])RO R R? Rc R R t -t +s 'all's /.*|N( s paths oversshs alloweds forbidden( R R R R4 RA R RW Rg R( RS t minusplust
expand_allRw R R? RY Rs R7 t listt myevalR8 ( R R1 RN R RV RA t stufft listeR? ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR) x s>
$ ! $ c C sv | j | r% | j | | } n! | d k r@ d d g } n g } | j | d | } | j d r | d k r xO | D]& } | d c t j j | d 7<q~ Wqex | D] } | j | q Wn | j d re| d k rxx | D]& } | d c t j j | d 7<q WqexG | D]< } | | k rD| j | q"| j j d | | f q"Wn i t
| | 6S( s= update configuration lists containing -/+ operators
R? R i R3 i s /.*|R2 s# CONF: -['%s'] ignored in '%s' list.( R R7 Rg R R? RY R t removeR R Rs ( R t confdictR t extraR9 t sublistR? RN ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR4 s,
'
'
c C s d d d d d d d d d d
d d d
d d d d d d d d d g } x t j d j d D]} } t j j | r xb t j | D]: } t j t j j | | t j r | j | q q Wq_ | j
j d | q_ Wt | S( s) expand allowed, if set to 'all'
t bgt breakt caseR( t continueRw t execR" t fgt ift jobst killt logint logoutt sett shiftR t suspendt umaskt unsett waitt whilet PATHt :s$ CONF: PATH entry "%s" does not exist(
R RR RA R? R R t accessR t X_OKR R R Rs ( R t expanded_allR RN ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR5 s $ R c C sM y t | } | SWn2 t k
rH | j j d | t j d n Xd S( s? if eval returns SyntaxError, log it as critical iconf missing s/ CONF: Incomplete %s field in configuration filei N( Rw t SyntaxErrorR RK R R" ( R RV R: t evaluated( ( s& /usr/lib/pymodules/python2.7/lshell.pyR7 s
c C si xb t D]Z } | | j j k r | j j d | d | j j d | j t j d q q Wd S( s This method checks if all the required fields by user are present for the present user.
In case fields are missing, the user is notified and exited from lshell.
s ERROR: Missing parameter 's 'sC ERROR: Add it in the in the [%s] or [default] section of conf file.i N( t required_configR( R R RK R' R R" ( R RN ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s
c C s* | j j d r y t | j d | j d <Wn t k
rC n X| j d d k rg d | j d <n# | j d d k r d | j d <n y" | j j | j | j d Wq t k
r q Xn x3d d d d d d d
d d d
d d d d d g D] } y$ | j | j | | | j | <Wq t
k
r| d0 k rMg | j | <q| d1 k rid | j | <q| d2 k rd | j | <q| d3 k ri | j | <q| d4 k rq qd | j | <q t k
r| j j
d | t j d q Xq W| j | j d <| j j d rq| j d j d | j d | j d <t j j | j | j d d | j d <n t j d | j d <| j j d rt | j d | j d <| j d d c | j d d 7<n/ d d g | j d <| j d d | j d d <| j j d r:| j | j d d | j d <n
d | j d <| j j d r| j | j d | j d <yO t j j | j d r| j d | j d <n | j j d | j d Wqt k
r| j j d qXn | j j d! r | j | j d! | j d! <n
t | j d! <| j j d" rq| j d" | j d" <| j | j | j d" d n t j j | j d rt j | j d n( | j j
d# | j d t j d | j j d$ r4y1 t | j d$ j d | j d | j d$ <WqA| j j d% | j d$ qAXn
t | j d$ <| j d$ j d& sd' | j d | j d$ f | j d$ <n t j d( | j d t j d( <| j d j d) | j d j d* | j d j d+ | j d j d, | j d j d- | j d r&| j d j d. n d/ S(5 s Once all the checks above have passed, the configuration files values are entered in a dict to be used by the command line it self.
The lshell command line is then launched!
R i i R R RB R R R t scpt
scp_uploadt scp_downloadt sftpRc R% R' R R ii s5 ERR: in the -%s- field. Check the configuration file.t usernameR& s %ut HOMER? s .*R t env_patht scpforces$ CONF: scpforce no such directory: %ss CONF: scpforce must be a string!R
t lock_counters( ERR: home directory "%s" does not exist.RD s CONF: history file error: %sRv s %s/%sRP R" R) R* R+ t clearRb N( s alloweds oversshs
sudo_commands( s history_size( RY RZ ( s aliasess env_vars( s prompt( R( R Rt R R R R R R R7 t KeyErrort TypeErrorR RK R R" R' R R R? t normpathRR Rw R R R
t account_lockR~ RX RD Rg R ( R RN ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s
"
$
%
!
c C s
| r n d S( s6 check if user account is locked, in which case, exit N( ( R R' R` t check( ( s& /usr/lib/pymodules/python2.7/lshell.pyRe o s c C s | j j d r t j j d rt j j d rd | j d k r | j d d k r | j j d t j | j d | j j d t j d q | j j d
t j d n t | j d( d( d( d( | j d } | j | j d d( d d r | j d | j d n t
| j d d } t
| j d d d
} x | j d j j d D]v } t j j | d } t j | | } | rt j | | } n d( } | s| rn| j d | j d qnqnW| j d j d r| j d d k s$d | j d k rd | j d k r| j d rb| j j d | j d q| j j d | j d t j d nd | j d k r| j d r|| j j d r^| j d j d } t j j | d
} t j j | j d }
| |
k r^| j j d d | | j d
| j |
t j | | j d <q^n | j j d | j d q| j j d | j d t j d n t j | j d | j j d t j d q| j d | j d d q| j d rt | j d | j d | j d <| j | j d d! d d d re| j d" | j d n | j j d# | j d | j d d$ k r| j d( n t j | j d | j j d% t j d q| j d& | j d q | j d' | j d n d( S() s This method checks if the user is trying to SCP a file onto the server. If this is the case, it checks if the user is allowed to use SCP or not, and acts as requested. : )
Ri t
SSH_CLIENTt SSH_TTYs sftp-serverR[ i s SFTP connects SFTP disconnecti s *** forbidden SFTP connections
path over SSHR? iRO Rv s scp RX Rc s -f RZ s
SCP: GET "%s"s SCP: download forbidden: "%s"s -t RY R_ s SCP: forced SCP s
directory: %ss
SCP: PUT "%s"s SCP: upload forbidden: "%s"s SCP disconnects SCP connectionR' R% s char/command over SSHs Over SSH: "%s"R. R$ s command over SSHs shell escapeN( R R R RR R R R; R R" R R R3 t ssh_warnRs Rf RA R? RY R4 Rd Rg R R t stringR R9 R0 R ( R t cliR R RN R R R t cmdsplitt scppatht
forcedpath( ( s& /usr/lib/pymodules/python2.7/lshell.pyR y s #
&
"c C s | d k r7 | j j d | | j j d | n | j j d | | f | j j d | j j d t j d d S( s+ log and warn if forbidden action over SSH RX s *** forbidden %ss *** SCP command: %ss *** forbidden %s: "%s"s! This incident has been reported.
R$ i N( R RK R R R/ R R" ( R t messageRC R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyRi s c C s | j j | j rQ | j j | j d rH | j j | j d } qW d } n d } | r t d | j d } | | k r | j j d | j j
d t j d q n d Sd S( sF As a passwd field is required by user. This method checks in the configuration file if the password is empty, in wich case, no password check is required. In the other case, the password is asked to be entered.
If the entered password is wrong, the user is exited from lshell.
t passwds Enter s
's password: s! Error: Wrong password
Exiting..
s WARN: Wrong passwordi N(
R R R' t
has_optiont getR R R R/ R RK R R" ( R Rp t password( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s c C s | j S( s returns the configuration dict ( R ( R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyt
returnconf s N( R R R R R R R R R R R R R R) R4 R5 R7 R R Re R Ri R Rt ( ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s* /
V &
i R c B s# e Z d Z d d Z d Z RS( s- Custum exception used for timer timeout
s Timed Outc C s
| | _ d S( N( RV ( R RV ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s c C s
t | j S( N( t reprRV ( R ( ( s& /usr/lib/pymodules/python2.7/lshell.pyt __str__ s ( R R R R Rv ( ( ( s& /usr/lib/pymodules/python2.7/lshell.pyR s c C s x | j D] } d | } x t j | | r t j | | d d } t j | | d d } t j | d | | | | f | d } | } | | k r Pq q Wq
Wx7 d d d g D]& } | j d | | f d | } q W| S(
s0 Replace all configured aliases in the line
s (^|; |;)%s([ ;&\|]+|$)i i s %s%s%st ;R_ R@ s %s%ss %s( R R4 Rd R5 R ( Rh R' RN t regt
beforecommandt aftercommandt linesavet char( ( s& /usr/lib/pymodules/python2.7/lshell.pyR9 s
$c C s t j j t j d t j d <t j j d rS t j d t t j d } n
t j d } t | j } y t
| } | j Wne t t
f k
r t j j d t j d n2 t k
r | d j d t j j d n Xd S(
s main function i t SHELLR i s
Exited on user request
R s
Timer expireds
Time is up.
N( R R? RY R t argvRR R Rw R Rt R R R R R R/ R" R R ( R R Rk ( ( s& /usr/lib/pymodules/python2.7/lshell.pyt main$ s !
t __main__($ R R R R R R R Rj R4 R R
R Ry RF R, R t
__author__R RW t exec_prefixt conf_prefixR RD t lock_fileR R R
R R1 R R t ExceptionR R9 R R ( ( ( s& /usr/lib/pymodules/python2.7/lshell.pyt <module> sJ
7