diff options
Diffstat (limited to 'files/usr/local/libexec')
3 files changed, 126 insertions, 0 deletions
diff --git a/files/usr/local/libexec/idm-ssh-authorized-keys.common b/files/usr/local/libexec/idm-ssh-authorized-keys.common new file mode 100644 index 0000000..d18b199 --- /dev/null +++ b/files/usr/local/libexec/idm-ssh-authorized-keys.common @@ -0,0 +1,43 @@ +#!/usr/local/bin/perl + +use strict; +use warnings; + +use Net::LDAP; +use Net::LDAP::Util qw(escape_filter_value); +use Authen::SASL; + +open my $fh, '<', '/usr/local/etc/openldap/ldap.conf' or quit($!); +my %config; +while (<$fh>) { + chomp; + next if /^#/; + my @pair = split(' ', $_, 2); + next unless (@pair == 2); + $config{$pair[0]} = $pair[1]; +} +close($fh); + +my $mech = $config{SASL_MECH} // 'GSSAPI'; +my $uri = $config{URI} // quit('URI not specified'); +my $basedn = $config{BASE} // quit('BASE not specified'); + +@ARGV == 1 or die "usage: $0 USERNAME\n"; +my $username = $ARGV[0]; + +my $conn = Net::LDAP->new($uri, version => '3') or die "$0: $@"; +my $sasl = Authen::SASL->new($mech); +my $status = $conn->bind(sasl => $sasl); +$status->code and die "$0: ".$status->error; + +my $search = $conn->search( + scope => 'sub', + base => "ou=accounts,$basedn", + filter => '(&(objectClass=posixAccount)(sshPublicKey=*)(uid=' . escape_filter_value($username) . '))', + attrs => ['sshPublicKey']); +$search->code and die "$0: ".$search->error; + +exit 0 if $search->entries == 0; +die "$0: multiple LDAP entries returned for user: $username\n" if $search->entries > 1; + +print "$_\n" foreach (($search->entries)[0]->get_value('sshPublicKey')); diff --git a/files/usr/local/libexec/idm-ssh-known-hosts.common b/files/usr/local/libexec/idm-ssh-known-hosts.common new file mode 100644 index 0000000..78b48fc --- /dev/null +++ b/files/usr/local/libexec/idm-ssh-known-hosts.common @@ -0,0 +1,51 @@ +#!/usr/local/bin/perl + +use strict; +use warnings; + +use Net::LDAP; +use Net::LDAP::Util qw(escape_filter_value); +use Authen::SASL; + +sub quit { + # Prints an error message and exits with code 0. + # NB: If KnownHostsCommand returns nonzero, the entire SSH connection aborts, + # which isn't what we want. + print STDERR "$0: $_[0]" if @_ > 0; + exit 0 +} + +@ARGV == 1 or die "usage: $0 HOSTNAME\n"; +my $hostname = $ARGV[0]; + +open my $fh, '<', '/usr/local/etc/openldap/ldap.conf' or quit($!); +my %config; +while (<$fh>) { + chomp; + next if /^#/; + my @pair = split(' ', $_, 2); + next unless (@pair == 2); + $config{$pair[0]} = $pair[1]; +} +close($fh); + +my $mech = $config{SASL_MECH} // 'GSSAPI'; +my $uri = $config{URI} // quit('URI not specified'); +my $basedn = $config{BASE} // quit('BASE not specified'); + +my $conn = Net::LDAP->new($uri, version => '3') or quit($@); +my $sasl = Authen::SASL->new($mech); +my $status = $conn->bind(sasl => $sasl); +$status->code and quit($status->error); + +my $search = $conn->search( + scope => 'sub', + base => "ou=hosts,ou=accounts,$basedn", + filter => '(&(sshPublicKey=*)(associatedDomain=' . escape_filter_value($hostname) . '))', + attrs => ['sshPublicKey']); +$search->code and quit($search->error); + +quit if $search->entries == 0; +quit("multiple LDAP entries returned for host: $hostname\n") if $search->entries > 1; + +print "$hostname $_\n" foreach (($search->entries)[0]->get_value('sshPublicKey')); diff --git a/files/usr/local/libexec/idm-update-unbound-blocklists.idm_server b/files/usr/local/libexec/idm-update-unbound-blocklists.idm_server new file mode 100644 index 0000000..c33b909 --- /dev/null +++ b/files/usr/local/libexec/idm-update-unbound-blocklists.idm_server @@ -0,0 +1,32 @@ +#!/bin/sh + +set -eu -o pipefail + +prog=$(basename "$(readlink -f "$0")") +usage="${prog} BLOCKLIST_DIR + Blocklist URLs are read from stdin." + +die() { + printf '%s: %s\n' "$prog" "$*" 1>&2 + exit 1 +} + +usage(){ + printf 'usage: %s\n' "$usage" 1>&2 + exit 2 +} + +[ $# -eq 1 ] || usage +case $1 in + -h|--help) usage ;; +esac + +[ -d "$1" ] || die "not a directory: ${1}" + +cd "$1" + +find . -maxdepth 1 -type f -exec rm {} + + +while read -r name url; do + [ -n "$url" ] && curl -sSfL -o "${name}.zone" "$url" +done |