BCC admins@ instead of docelic@ in quota check
[clinton/scripts.git] / freeze
CommitLineData
86a0f2e2 1#!/usr/bin/perl
2
3#
4# Purpose: freeze user (cancel user services except email), or unfreeze user.
5#
6# Usage (RUN AS _ADMIN USER ON DELEUZE WITHOUT SUDO):
7#
8# Display frozen users or details for one user (one user implies -verbose):
9# freeze [user], OR
2639c68f 10# freeze [ --action list | -a ] [--verbose | -v] [user]
86a0f2e2 11#
12# Freeze user:
13# freeze -a f user
14#
15# Unfreeze:
16# freeze -a u user
17#
18#
19# How it works:
20#
21# Script invokes a list of modules, where each module knows how to
22# implement and unimplement a specific restriction. Implemented modules
23# should be listed in @modules array or they won't get called. Admin
24# can override list of modules with --modules=one,two,three.
25#
26# Modules execute in the order as specified for freeze, and in reverse
27# order for unfreeze.
28#
29# Module gets called as &module($action, $user) . The proper way to
30# test for which action is requested is as shown below. (Note that
31# module adds or removes itself to the list of modules that ran on the user).
32#
33# if ($a =~ /^f/i) {
34# ... freeze ...
35# push @{ $$store{$u}{modules} }, 'MODULE';
36# } elsif ($a =~ /^u/i) {
37# ... unfreeze ...
38# @{ $$store{$u}{modules} } = grep {!/^MODULE$/} @{ $$store{$u}{modules} };
39# }
40#
41# Also each system-modifying action should be wrapped in if (!DRY) as shown:
42#
43# if (!DRY) {
44# system(qq{SOME COMMAND})
45# } else {
46# warn qq|SOME COMMAND|
47# }
48#
49# User is valid system username, and user's getent entry is prepared and
50# retrievable through @user array, should you need some of its info.
51#
52# Module can save all persistent data to $$store{$user}{$modulename}. For
53# example, after cron module removes user from all cron.allows, it
54# registers the machines where user was removed to
55# @{ $$store{$u}{cron} }, so that it can revert it back if user is
56# unfreezed.
57#
58# Module 'record' creates or deletes initial user entry in $$store.
2639c68f 59# If you create a new module that will use the store, announce its
86a0f2e2 60# hash key by creating it empty in record().
61#
2639c68f 62# For additional detail, here's how the stored hash might look like:
86a0f2e2 63#
64#
65# $store = {
66# user1 => {
67# date => 'Sun Jun 29 18:45:43 CEST 2008',
68# getent => [qw/docelic 1000 1000 DavorOcelic /home/docelic /bin/bash]
69#
70# modules => [qw/login domtool cron slay/], # (modules that ran)
71# domains => [qw/spinlock.hr test.hr/], # (domains that were removed)
72# cron => [qw/mire/], # (hosts where cron.allow entry was removed)
73# },
74# user2 => {
75# ...
76# },
77# ...
78# ...
79# ...
80# }
81#
82#
83# Wiki page relating to this script is http://wiki.hcoop.net/MemberFreezing
84#
85# Davor Ocelic, docelic@hcoop.net, Sun Jun 29 18:41:02 CEST 2008
86#
87#
88
89use warnings;
90use strict;
91
92use Storable qw/lock_nstore lock_retrieve/;
93use Getopt::Long qw/GetOptions/;
94
95use constant DEBUG => 1;
2639c68f 96use constant DRY => 0;
97use constant STORE => "/var/tmp/frozen/cache";
86a0f2e2 98use constant DEFAULT_SHELL => '/bin/bash';
99use constant FROZEN_SHELL => '/afs/hcoop.net/common/etc/scripts/frozen_shell';
2639c68f 100use constant PUBLIC_ACCESS => (qw/mire/);
101use constant RUN_SERVER => 'deleuze';
86a0f2e2 102
103my $store = {}; # cached info
104my $action = 'list'; # list, freeze, unfreeze
105my $verbose = 0; # 0/1 (print which modules were applied to user in freezing)
106my $force = 0; # 0/1 (force action even if user already freezed/unfreezed)
107my $user; # who to freeze/unfreeze
108my @user; # getent passwd entry for user
109my $modules; # list of freeze/unfreeze actions to take
110my @modules; # modules, possibly overriden by split /,\s+/, $modules
111
112# Keep modules listed in order of application, honoring possible dependencies.
113@modules = (qw/record login domtool slay/);
114
115unless ( GetOptions (
116 'do|d|a=s' => \$action,
117 'verbose|v!' => \$verbose,
118 'force!' => \$force,
119 'modules|m=s' => \$modules,
120)) { die "Error parsing options: $!\n" }
121
122$user = shift ;
123
2639c68f 124if ( $> == 0 or $< == 0 ) {
125 die "Run script under admin account without sudo.\n";
126}
127
86a0f2e2 128if ( -e STORE ) {
129 $store = lock_retrieve(STORE);
130} else {
131 warn "No '" . STORE . "', skipping load.\n";
132}
133
134if ( `hostname` ne RUN_SERVER . "\n" ) {
135 die "Please run script on " . RUN_SERVER . "\n";
136}
137
138if ( $action =~ /^l/i ) {
139 while (my ($k,$v) = each %$store ) {
140 if (! $user or $user eq $k ) {
141 print "$k $$v{date}\n";
142 print " @{$$v{modules}}\n" if $verbose or $user;
143 }
144 }
145 exit 0;
146}
147
148$user or die "Must specify user to freeze/unfreeze. Exiting.\n";
149$user =~ /^[a-z0-9]+$/ or die "Invalid username (not [a-z0-9]+).\n";
150@user = split(/:/, `getent passwd $user`);
151@user or die "No such user? (getent passwd USER empty.)\n";
152chomp $user[$#user];
153
154if ( $action !~ /^[fu]/i ) {
155 warn "Unknown action: use -a [list (l)|freeze (f)|unfreeze (u)]\n";
156}
157
158if ( $action =~ /^f/i ) {
159 if ( exists $$store{$user} ) {
160 warn "User already frozen since $$store{$user}{date}.\n";
161 if (! $force) {
162 die "Exiting.\n";
163 }
164 }
165}
166
167elsif ( $action =~ /^u/i ) {
168 if (! exists $$store{$user} ) {
169 warn "User not frozen in the first place.\n";
170 if (! $force) {
171 die "Exiting.\n";
172 }
173 }
174}
175
176else {
177 warn "How did you get through?\n";
178 die;
179}
180
181
182if ($modules) { @modules = split /[,\s+]/, $modules; }
183for ( $action =~ /^u/i ? reverse @modules : @modules ) {
184 no strict 'refs';
185 print "Module: $_\n";
186 &{ $_ }($action, $user);
187}
188
189lock_nstore $store, STORE;
190
191
192###########################################################################
193# Helpers below
194
2639c68f 195# GETENT (available to modules automatically in @user):
86a0f2e2 196# 0 1 2 3 4 5 6
197# docelic:x:10235:65534:docelic:/afs/hcoop.net/user/d/do/docelic:/bin/bash
198
199sub record {
200 my ($a, $u) = @_;
201 $a =~ /^f/i and $$store{$u} = {
202 date => scalar localtime,
203 getent => [ @user ],
204 modules => [],
205 domains => [],
206 cron => [],
207 };
208 $a =~ /^u/i and delete $$store{$u};
209}
210
211sub login {
212 my ($a, $u) = @_;
213
214 if ($a =~ /^f/i) {
215 if ( $user[6] ne DEFAULT_SHELL ) {
216 $$store{$u}{shell} = $user[6] unless $user[6] eq FROZEN_SHELL;
217 }
218
219
220 if ( -e "$user[5]/.loginshell" ) {
221 if (!DRY) {
222 unlink "$user[5]/.loginshell" or warn "unlink: $!"
223 } else {
224 warn qq{unlink $user[5]/.loginshell\n};
225 }
226 }
227
228 if (!DRY) {
229 symlink FROZEN_SHELL, "$user[5]/.loginshell"
230 or warn "symlink: $!";
231 } else {
232 warn qq{symlink FROZEN_SHELL, "$user[5]/.loginshell"\n}
233 }
234
235 push @{ $$store{$u}{modules} }, 'login';
236
237 if ( -x "/usr/sbin/nscd" ) { system("sudo /usr/sbin/nscd -i passwd") };
238 }
239
240 elsif ($a =~ /^u/i) {
241 if ( $$store{$u}{shell}) {
242 if ( -l "$user[5]/.loginshell" or -e "$user[5]/.loginshell" ) {
243 if (!DRY) {
244 system("rm '$user[5]/.loginshell'");
245 } else {
246 warn qq{system("rm '$user[5]/.loginshell'")\n};
247 }
248 }
249 if (!DRY) {
250 symlink($$store{$u}{shell}, "$user[5]/.loginshell")
251 or warn "symlink: $!";
252 } else {
253 warn qq|symlink($$store{$u}{shell}, "$user[5]/.loginshell")\n|;
254 }
255 }
256
257 @{ $$store{$u}{modules} } = grep {!/^login$/} @{ $$store{$u}{modules} };
258
259 if ( -x "/usr/sbin/nscd" ) { system("sudo /usr/sbin/nscd -i passwd") };
260 }
261}
262
263
264sub domtool {
265 my ($a, $u) = @_;
266
267 # XXX handle all types of domtool privs, not just domains
268 # XXX how to restart services after that?
269
270 if ($a =~ /^f/i) {
2639c68f 271 my $domains = `domtool-admin perms $u | grep '^domain: '`;
86a0f2e2 272 chomp $domains;
273 my @domains = split / +/, $domains;
274
275 for (@domains) {
276 push @{ $$store{$u}{domains} }, $_;
e3f713a3 277
278 # As per adamc's suggestion, I should not be
279 # running rmdom explicitly.
280 # https://bugzilla.hcoop.net/show_bug.cgi?id=555
281 #if (!DRY) {
282 # system("domtool-admin rmdom $_")
283 #} else {
284 # warn qq|system("domtool-admin rmdom $_")\n|
285 #}
86a0f2e2 286 }
287
d5a2aada 288 if (!DRY) {
289 system("domtool-rmuser $u")
290 } else {
291 warn qq|system("domtool-rmuser $u")\n|
292 }
86a0f2e2 293
294 push @{ $$store{$u}{modules} }, 'domtool';
295 }
296
297 elsif ($a =~ /^u/i) {
d5a2aada 298 if (!DRY) {
299 system("domtool-adduser $u")
300 } else {
301 warn qq|system("domtool-adduser $u")\n|
302 }
86a0f2e2 303
304 for ( @{ $$store{$u}{domains} } ) {
305 if (!DRY) {
306 system("domtool-admin grant $u domain $_")
307 } else {
308 warn qq|system("domtool-admin grant $u domain $_")\n|
309 }
310 }
311
312 @{ $$store{$u}{modules} } = grep {!/^domtool$/} @{ $$store{$u}{modules} };
313 }
314}
315
316
317
318sub cron {
319 my ($a, $u) = @_;
320
321 if ($a =~ /^f/i) {
322 for ( PUBLIC_ACCESS ) {
323 if ( qx{ssh -K $_ grep -E '^$u\$' /etc/cron.allow }) {
324 push @{ $$store{$u}{cron} }, $_;
325
326 if (!DRY) {
327 qx{ssh -K $_ perl -ni -e 'print unless /^\$/' /etc/cron.allow }
328 } else {
329 warn qq{ssh -K $_ perl -ni -e 'print unless /^\$/' /etc/cron.allow\n}
330 }
331 }
332 }
333
334 push @{ $$store{$u}{modules} }, 'cron';
335 }
336
337 elsif ($a =~ /^u/i) {
338 for ( @{ $$store{$u}{cron} } ) {
339 if (!DRY) {
340 qx{ssh -K $_ sh -c 'echo $u >> /etc/cron.allow'};
341 } else {
342 warn qq{ssh -K $_ sh -c 'echo $u >> /etc/cron.allow'\n};
343 }
344 }
345
346 @{ $$store{$u}{modules} } = grep {!/^cron$/} @{ $$store{$u}{modules} };
347 }
348}
349
350
351sub slay {
352 my ($a, $u) = @_;
353
354 if ($a =~ /^f/i) {
355 for ( PUBLIC_ACCESS ) {
356 if (!DRY) {
2639c68f 357 qx{ssh -K $_ sudo slay $u}; sleep 5; qx{ssh -K $_ sudo slay -9 $u};
86a0f2e2 358 } else {
2639c68f 359 warn qq|ssh -K $_ sudo slay $u; sleep 5; ssh -K $_ sudo slay -9 $u\n|
86a0f2e2 360 }
361 }
362
363 push @{ $$store{$u}{modules} }, 'slay';
364 }
365
366 elsif ($a =~ /^f/i) {
367 @{ $$store{$u}{modules} } = grep {!/^slay$/} @{ $$store{$u}{modules} };
368 }
369}
370
371