x2go-commits

x2go-commits@lists.x2go.org

1 participants
37910 discussions

x2gobroker.git - master (branch) updated: 0.0.0.1-45-gf703bae
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via f703baeb847d1ac9c877faee34f93e08e0af22d6 (commit) from 62675904dff3890b3cd24cc9d819d4040bd38530 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f703baeb847d1ac9c877faee34f93e08e0af22d6 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Thu Feb 21 00:58:26 2013 +0100 fine-tuning of the select_session handshake ----------------------------------------------------------------------- Summary of changes: x2gobroker/agent.py | 4 +++- x2gobroker/brokers/base_broker.py | 2 +- x2gobroker/web/plain.py | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-) The diff of changes is: diff --git a/x2gobroker/agent.py b/x2gobroker/agent.py index 1192063..d055079 100644 --- a/x2gobroker/agent.py +++ b/x2gobroker/agent.py @@ -50,7 +50,9 @@ def call_local_broker_agent(username, mode): shell=False, ) - return agent_process.stdout.read().split('\n') + result = agent_process.stdout.read().split('\n') + if result[0].startswith('OK'): + return result[1:] def call_remote_broker_agent(username, mode, remote_agent): """\ diff --git a/x2gobroker/brokers/base_broker.py b/x2gobroker/brokers/base_broker.py index 54d68e6..9e811c0 100644 --- a/x2gobroker/brokers/base_broker.py +++ b/x2gobroker/brokers/base_broker.py @@ -770,7 +770,7 @@ class X2GoBroker(object): # if resuming, always select the first session in the list, there should only be one suspended session server_name = session_list[0].split('|')[3] - session_info = session_list[0].split('|')[1] + session_info = session_list[0] selected_session.update({ 'server': server_name, diff --git a/x2gobroker/web/plain.py b/x2gobroker/web/plain.py index 70ce4a6..2e88de9 100644 --- a/x2gobroker/web/plain.py +++ b/x2gobroker/web/plain.py @@ -156,8 +156,8 @@ class X2GoBrokerWebPlain: if profile_info.has_key('authentication_key'): output += "" if profile_info.has_key('session_info'): - output += "SESSION_INFOS:\n" - output += "\n".join(profile_info['session_info']) + "\n" + output += "SESSION_INFO:" + output += profile_info['session_info'] + "\n" return output hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-44-g6267590
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via 62675904dff3890b3cd24cc9d819d4040bd38530 (commit) from 7009b45598b63ddc76192f7fc87bc9a80b15e8bc (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 62675904dff3890b3cd24cc9d819d4040bd38530 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 23:44:32 2013 +0100 simplyfy findbusyservers mode in broker agent ----------------------------------------------------------------------- Summary of changes: lib/x2gobroker-agent.pl | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) The diff of changes is: diff --git a/lib/x2gobroker-agent.pl b/lib/x2gobroker-agent.pl index 481de06..3155837 100755 --- a/lib/x2gobroker-agent.pl +++ b/lib/x2gobroker-agent.pl @@ -121,36 +121,28 @@ if( ($mode eq 'findbusyservers_by_sessionstats') || ($mode eq 'findbusyservers') InitX2GoUser($uid, $uidNumber, $gidNumber, $home); print "OK\n"; - my $session_list = `/bin/su - -c \"x2golistsessions_root --all-servers\"`; my $busy_servers = `/bin/su - $uid -c \"x2gogetservers\"`; - my $amount_sessions = 0; - # initialize server_load hash my %server_load = (); + my $num_sessions = 0; foreach (split('\n', $busy_servers)) { - $server_load{$_} = 0; - } - - # count sessions per server - my @session_list = split(/\n/, $session_list); - foreach (@session_list) - { - my ($apid, $sid, $disp, $hostname, $stat, $dcreated, $cookie, $gport, $sndport, $dsusp, $username, $fsport) = split('\\|', $_); - $amount_sessions++; - $server_load{$hostname} += 1; + my ($hostname, $num_users) = split(' ', $_); + $server_load{$hostname} = $num_users; + $num_sessions += $num_users; } # render the output result my @result; for my $hostname ( keys %server_load ) { - my $available = $server_load{$hostname}/$amount_sessions*100; + my $available = $server_load{$hostname}/$num_sessions*100; push @result, sprintf '%1$d:%2$s', $available, $hostname; } - print join('\n', sort @result); + print join("\n", sort @result); print "\n"; } + if($mode eq 'getservers') { InitX2GoUser($uid, $uidNumber, $gidNumber, $home); hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-43-g7009b45
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via 7009b45598b63ddc76192f7fc87bc9a80b15e8bc (commit) from 0be15373a8d8833277f8dcdb7274f2e4d425721a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7009b45598b63ddc76192f7fc87bc9a80b15e8bc Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 22:46:02 2013 +0100 fixes after testing broker agent calls ----------------------------------------------------------------------- Summary of changes: x2gobroker/agent.py | 6 +++--- x2gobroker/brokers/base_broker.py | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) The diff of changes is: diff --git a/x2gobroker/agent.py b/x2gobroker/agent.py index 3fe9feb..1192063 100644 --- a/x2gobroker/agent.py +++ b/x2gobroker/agent.py @@ -103,7 +103,7 @@ def list_sessions(username, query_mode='LOCAL', remote_agent=None): @type remote_agent: C{dict} """ - if query_mode == 'LOCAL': + if query_mode.upper() == u'LOCAL': return call_local_broker_agent(username, mode='listsessions') else: return call_remote_broker_agent(username, mode='listsessions', remote_agent=remote_agent) @@ -124,7 +124,7 @@ def find_busy_servers(username, query_mode='LOCAL', remote_agent=None): @type remote_agent: C{dict} """ - if query_mode == 'LOCAL': + if query_mode.upper() == u'LOCAL': server_list = call_local_broker_agent(username, mode='findbusyservers') else: server_list = call_remote_broker_agent(username, mode='findbusyservers', remote_agent=remote_agent) @@ -152,7 +152,7 @@ def get_servers(username, query_mode='LOCAL', remote_agent=None): @type remote_agent: C{dict} """ - if query_mode == 'LOCAL': + if query_mode.upper() == u'LOCAL': return call_local_broker_agent(username, mode='getservers') else: return call_local_broker_agent(username, mode='getservers', remote_agent=remote_agent) diff --git a/x2gobroker/brokers/base_broker.py b/x2gobroker/brokers/base_broker.py index 13235cb..54d68e6 100644 --- a/x2gobroker/brokers/base_broker.py +++ b/x2gobroker/brokers/base_broker.py @@ -736,7 +736,7 @@ class X2GoBroker(object): if len(server_list) >= 2: remote_agent = None - if agent_query_mode == 'SSH': + if agent_query_mode.upper() == u'SSH': random.shuffle(server_list) remote_agent_server = server_list[0] remote_agent_port = profile[u'sshport'] @@ -765,7 +765,7 @@ class X2GoBroker(object): # do some load balancing if more than one server is configured if len(server_list) >= 2 and username: - session_list = x2gobroker.agent.list_sessions(username=username) + session_list = x2gobroker.agent.list_sessions(username=username, query_mode=agent_query_mode, remote_agent=remote_agent) if session_list: # if resuming, always select the first session in the list, there should only be one suspended session hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-42-g0be1537
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via 0be15373a8d8833277f8dcdb7274f2e4d425721a (commit) from 9ed3a78cd49d01e4c056b8d93ae8b2f3709a00c4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0be15373a8d8833277f8dcdb7274f2e4d425721a Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 22:24:39 2013 +0100 typo fix in init script ----------------------------------------------------------------------- Summary of changes: debian/x2gobroker-authservice.init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) The diff of changes is: diff --git a/debian/x2gobroker-authservice.init b/debian/x2gobroker-authservice.init index d531f78..c00c800 100755 --- a/debian/x2gobroker-authservice.init +++ b/debian/x2gobroker-authservice.init @@ -84,7 +84,7 @@ case "${1:-}" in ;; stop) if [ -f $PIDFILE_AUTHSERVICE ] ; then - log_daemon_msg "X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" + log_daemon_msg "Stopping X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" set +e start-stop-daemon -K -p $PIDFILE_AUTHSERVICE rm -f $PIDFILE_AUTHSERVICE hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-41-g9ed3a78
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via 9ed3a78cd49d01e4c056b8d93ae8b2f3709a00c4 (commit) from 169a3bb77b455408af57f65ab47ed1ea63df4287 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9ed3a78cd49d01e4c056b8d93ae8b2f3709a00c4 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 22:10:34 2013 +0100 fix .deb package build ----------------------------------------------------------------------- Summary of changes: debian/control | 1 + debian/python-x2gobroker.postinst | 47 ------------------------------------- debian/x2gobroker-daemon.postinst | 5 ++++ debian/x2gobroker-daemon.postrm | 4 ++++ 4 files changed, 10 insertions(+), 47 deletions(-) delete mode 100755 debian/python-x2gobroker.postinst The diff of changes is: diff --git a/debian/control b/debian/control index 833c10f..769975d 100644 --- a/debian/control +++ b/debian/control @@ -84,6 +84,7 @@ Architecture: all Depends: ${misc:Depends}, ${python:Depends}, + adduser, x2gobroker (>= ${source:Version}), x2gobroker (<< ${source:Version}.1~), Recommends: x2gobroker-authservice, diff --git a/debian/python-x2gobroker.postinst b/debian/python-x2gobroker.postinst deleted file mode 100755 index 6299aea..0000000 --- a/debian/python-x2gobroker.postinst +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/sh -# postinst script for python-x2gobroker -# -# see: dh_installdeb(1) - -set -e - -# summary of how this script can be called: -# * <postinst> `configure' <most-recently-configured-version> -# * <old-postinst> `abort-upgrade' <new version> -# * <conflictor's-postinst> `abort-remove' `in-favour' <package> -# <new-version> -# * <postinst> `abort-remove' -# * <deconfigured's-postinst> `abort-deconfigure' `in-favour' -# <failed-install-package> <version> `removing' -# <conflicting-package> <version> -# for details, see http://www.debian.org/doc/debian-policy/ or -# the debian-policy package - - -case "$1" in - configure) - - # the python-x2gobroker needs special permissions on its log directory - if ! dpkg-statoverride --list /var/log/x2gobroker >/dev/null; then - dpkg-statoverride --add --update x2gobroker adm 2750 /var/log/x2gobroker - fi - - ;; - - abort-upgrade|abort-remove|abort-deconfigure) - ;; - - *) - echo "postinst called with unknown argument \`$1'" >&2 - exit 1 - ;; -esac - -# dh_installdeb will replace this with shell code automatically -# generated by other debhelper scripts. - -#DEBHELPER# - -exit 0 - - diff --git a/debian/x2gobroker-daemon.postinst b/debian/x2gobroker-daemon.postinst index fca14ca..dea98bc 100755 --- a/debian/x2gobroker-daemon.postinst +++ b/debian/x2gobroker-daemon.postinst @@ -40,6 +40,11 @@ case "$1" in echo "User x2gobroker already exists." >&2 fi + # the x2gobroker-daemon needs special permissions on its log directory + if ! dpkg-statoverride --list /var/log/x2gobroker >/dev/null; then + dpkg-statoverride --add --update x2gobroker adm 2750 /var/log/x2gobroker + fi + ;; abort-upgrade|abort-remove|abort-deconfigure) diff --git a/debian/x2gobroker-daemon.postrm b/debian/x2gobroker-daemon.postrm index 678bbb9..a8ebd42 100755 --- a/debian/x2gobroker-daemon.postrm +++ b/debian/x2gobroker-daemon.postrm @@ -19,6 +19,10 @@ set -e case "$1" in purge) + if dpkg-statoverride --list /var/log/x2gobroker >/dev/null; then + dpkg-statoverride --remove /var/log/x2gobroker + fi + if [ ! -d /usr/share/doc/x2gobroker-agent ]; then # remove user/group x2gobroker from system (only if not in use by x2gobroker-agent getent passwd x2gobroker >/dev/null && deluser x2gobroker hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-40-g169a3bb
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via 169a3bb77b455408af57f65ab47ed1ea63df4287 (commit) via 1c5e41f4849a2c8273eb96bf09b5c9993a9c7a3f (commit) from 769d5c17f51f20e91f8bff1fb1830fba2ade4e05 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 169a3bb77b455408af57f65ab47ed1ea63df4287 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 21:26:03 2013 +0100 code cleanup using pyflakes commit 1c5e41f4849a2c8273eb96bf09b5c9993a9c7a3f Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 21:14:00 2013 +0100 more work on the session broker (this commit might break functionality) ----------------------------------------------------------------------- Summary of changes: etc/x2gobroker.conf | 45 ++++++++++++++ lib/x2gobroker-agent.pl | 31 +++++++--- test.py | 1 - x2gobroker/agent.py | 122 +++++++++++++++++++++++++++++-------- x2gobroker/brokers/base_broker.py | 50 +++++++++++++-- x2gobroker/brokers/ldap_broker.py | 2 +- x2gobroker/defaults.py | 2 + x2gobroker/web/json.py | 1 - x2gobroker/web/plain.py | 1 - 9 files changed, 212 insertions(+), 43 deletions(-) The diff of changes is: diff --git a/etc/x2gobroker.conf b/etc/x2gobroker.conf index 83f6bd8..b512cf4 100644 --- a/etc/x2gobroker.conf +++ b/etc/x2gobroker.conf @@ -90,6 +90,50 @@ # CPU intensive on the X2Go Broker server. #ignore-primary-group-memberships = true +# default X2Go Broker Agent query mode: +# +# The X2Go Broker Agent is needed for multi-server sites configured for +# load balancing. Multi-server sites require a setup that uses the +# PostgreSQL X2Go session DB backend. The X2Go Broker Agent has to be installed +# on the local system (mode: LOCAL) or on all X2Go Servers (mode: SSH) in a +# multi-server farm. +# +# So, there are two query modes for the X2GO Broker Agent: LOCAL and SSH. +# +# LOCAL - This LOCAL mode only works for _one_ configured multi-server farm. +# If the locally installed X2Go Session Broker is to server many different +# multi-server farms, then the LOCAL mode will not work!!! +# +# How it works: Assume that the local system has an X2Go Broker Agent +# that knows about the multi-server setup. This means: X2Go Server has +# to be installed locally and the X2Go Server has to be configured to +# use the multi-server farms PostgreSQL session DB backend. +# +# The local system that is running the broker does not necessarily have +# to be a real application server. It only has to be aware of running/suspended +# sessions within the X2Go multi-server farm setup. +# +# A typical use-case is X2Go on top of a Debian Edu Terminal-Server farm: +# +# TJENER -> PostgreSQL DB, X2Go Server, X2Go Session Broker + Broker Agent +# TS01 - TS0X -> X2Go Server configured to use the PostgreSQL DB on TJENER +# +# SSH - The more generic approach, but also more complex. It allows that the broker +# on this system may serve for many different X2Go Server multi-server setups. +# +# With the SSH agent query mode, the X2Go Session Broker will query one of the X2Go +# Servers in the targeted multi-server setup (through SSH). The SSH authentication +# is done by a system user account (normally UID=x2gobroker) and SSH pub/priv +# key authentication has to be configured to make this work. +# +# All X2Go Servers in a multi-server farm need the X2Go Broker Agent installed, +# whereas this local system running the X2Go Session Broker does not need a +# local X2Go Broker Agent at all. + +# The agent query mode can be configured on a per-broker-backend basis, the below value is +# the default. +#default-agent-query-mode=LOCAL + ### ### BACKEND section ### @@ -136,3 +180,4 @@ #host-search-filter = (&(objectClass=ipHost)(serial=X2GoServer)(cn=*)) #group-search-filter = (&(objectClass=posifxGroup)(cn=*)) #starttls = false +#agent-query-mode = SSH diff --git a/lib/x2gobroker-agent.pl b/lib/x2gobroker-agent.pl index 74e0751..481de06 100755 --- a/lib/x2gobroker-agent.pl +++ b/lib/x2gobroker-agent.pl @@ -98,17 +98,36 @@ if($mode eq 'listsessions') exec ("/bin/su - $uid -c \"x2golistsessions --all-servers\""); } -if($mode eq 'findbestserver_by_sessionstats') || ($mode eq 'findbestserver') +if( ($mode eq 'findbusyservers_by_sessionstats') || ($mode eq 'findbusyservers')) { + + # Normally the session broker setup knows about all servers, + # make sure your configuration of X2Go Session Broker is correct and + # lists all available servers. + + # The findbusyservers algorithm only returns servers that are currently + # in use (i.e. have running or suspended sessions on them). So the + # result may be empty or contain a server list not containing all + # available servers. + + # The logic of findbusyservers is this, then: + # 1. if no server is returned, any of the configured servers is best server + # 2. if some servers are returned, a best server is one that is not returned + # 3. if all configured servers are returned, than evaluate the usage value + # (e.g. 90:server1, 20:server2, 10:server3 -> best server is server3) + + # The above interpretation has to be handled by the broker implementation + # calling »x2gobroker-agent findbusyservers«. + InitX2GoUser($uid, $uidNumber, $gidNumber, $home); print "OK\n"; my $session_list = `/bin/su - -c \"x2golistsessions_root --all-servers\"`; - my $avail_servers = `/bin/su - $uid -c \"x2gogetservers\"`; + my $busy_servers = `/bin/su - $uid -c \"x2gogetservers\"`; my $amount_sessions = 0; # initialize server_load hash my %server_load = (); - foreach (split('\n', $avail_servers)) + foreach (split('\n', $busy_servers)) { $server_load{$_} = 0; } @@ -125,17 +144,13 @@ if($mode eq 'findbestserver_by_sessionstats') || ($mode eq 'findbestserver') # render the output result my @result; for my $hostname ( keys %server_load ) { - my $available = 100-$server_load{$hostname}/$amount_sessions*100; - if ($available eq 0) { - $available = 100; - } + my $available = $server_load{$hostname}/$amount_sessions*100; push @result, sprintf '%1$d:%2$s', $available, $hostname; } print join('\n', sort @result); print "\n"; } - if($mode eq 'getservers') { InitX2GoUser($uid, $uidNumber, $gidNumber, $home); diff --git a/test.py b/test.py index a8c53df..b04e9ee 100755 --- a/test.py +++ b/test.py @@ -22,7 +22,6 @@ Unit tests for Python X2GoBroker. """ import os -import logging if __name__ == "__main__": os.environ.update({'X2GOBROKER_DEBUG': "1"}) diff --git a/x2gobroker/agent.py b/x2gobroker/agent.py index 81edc04..3fe9feb 100644 --- a/x2gobroker/agent.py +++ b/x2gobroker/agent.py @@ -20,13 +20,16 @@ # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. import subprocess +import paramiko # X2Go Broker modules import x2gobroker.defaults +from x2gobroker.loggers import logger_error -def call_broker_agent(username, mode): + +def call_local_broker_agent(username, mode): """\ - Launch X2Go Broker Agent and process its output. + Launch X2Go Broker Agent locally and process its output. @param username: run the broker agent for this user @type username: C{unicode} @@ -40,48 +43,117 @@ def call_broker_agent(username, mode): '{mode}'.format(mode=mode), ] - subprocess.Popen(cmd_line, - stdin=None, - stdout=subprocess.PIPE, - stderr=subprocess.STDOUT, - shell=False, + agent_process = subprocess.Popen(cmd_line, + stdin=None, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + shell=False, ) - return subprocess.stdout.read() + return agent_process.stdout.read().split('\n') + +def call_remote_broker_agent(username, mode, remote_agent): + """\ + Launch remote X2Go Broker Agent via SSH and process its output. + + @param username: run the broker agent for this user + @type username: C{unicode} + @param mode: execution mode of the broker (listsessions, getservers, etc.) + @type mode: C{unicode} + @param remote_agent: information about the remote agent that is to be called. + @type remote_agent: C{dict} + + """ + cmd_line = [ + '{x2gobroker_agent_binary}'.format(x2gobroker_agent_binary=x2gobroker.defaults.X2GOBROKER_AGENT_CMD), + '{username}'.format(username=username), + '{mode}'.format(mode=mode), + ] -def list_sessions(username): + remote_username = x2gobroker.defaults.X2GOBROKER_USER + remote_hostname = remote_agent[u'hostname'] + remote_port = int(remote_agent[u'port']) + + # now, connect and use paramiko Client to negotiate SSH2 across the connection + try: + client = paramiko.SSHClient() + client.load_system_host_keys() + client.set_missing_host_key_policy(paramiko.WarningPolicy) + client.connect(remote_hostname, remote_port, remote_username, look_for_keys=True, allow_agent=True) + + ssh_transport = client.get_transport() + if ssh_transport.is_authenticated(): + cmd = cmd_line.join(' ') + cmd = 'sh -c \"{cmd}\"'.format(cmd=cmd) + (stdin, stdout, stderr) = client.exec_command(cmd) + client.close() + return stdout.read().split('\n') + except paramiko.SSHException: + logger_error.error('could not connect to remote X2Go Broker Agent (user: {user}, hostname: {hostname}, port: {port}'.format(user=remote_username, hostname=remote_hostname, port=remote_port)) + +def list_sessions(username, query_mode='LOCAL', remote_agent=None): """\ Query X2Go Broker Agent for a session list for a given username. - @param username: username for who to query a session list + @param username: run the query on behalf of this username @type username: C{unicode} + @param query_mode: query mode used when calling X2Go Broker Agent (C{LOCAL} or C{SSH}) + @type query_mode: C{unicode} + @param remote_agent: information about the remote agent that is to be called. + @type remote_agent: C{dict} """ - return call_broker_agent(username, mode='listsessions') + if query_mode == 'LOCAL': + return call_local_broker_agent(username, mode='listsessions') + else: + return call_remote_broker_agent(username, mode='listsessions', remote_agent=remote_agent) -def find_best_server(username=None): +def find_busy_servers(username, query_mode='LOCAL', remote_agent=None): """\ - Query X2Go Broker Agent for the best server for the given user. - In many cases the username does not have an effect on the - detection of an optimal server. + Query X2Go Broker Agent for a list of servers with running + and/or suspended sessions and a percentage that tells about + the busy-state of the server. - @param username: username for who to query a session list + The result is independent from the username given. + + @param username: run the query on behalf of this username @type username: C{unicode} + @param query_mode: query mode used when calling X2Go Broker Agent (C{LOCAL} or C{SSH}) + @type query_mode: C{unicode} + @param remote_agent: information about the remote agent that is to be called. + @type remote_agent: C{dict} """ - server_list = call_broker_agent(username, mode='findbestserver') - server_list.sort(reverse=True) - return server_list[0].split(':')[1] + if query_mode == 'LOCAL': + server_list = call_local_broker_agent(username, mode='findbusyservers') + else: + server_list = call_remote_broker_agent(username, mode='findbusyservers', remote_agent=remote_agent) + + server_usage = {} + + if server_list: + for server_item in server_list.split('\n'): + usage, server = server_item.split(':') + server_usage.update({ server: int(usage) }) -def get_servers(username=None): + return server_usage + +def get_servers(username, query_mode='LOCAL', remote_agent=None): """\ - Query X2Go Broker Agent for the list of available servers - for the given user. In many cases the username does not - have an effect on the list of available servers. + Query X2Go Broker Agent for the list of currently used servers. + + The result is independent from the username given. - @param username: username for who to query a session list + @param username: run the query on behalf of this username @type username: C{unicode} + @param query_mode: query mode used when calling X2Go Broker Agent (C{LOCAL} or C{SSH}) + @type query_mode: C{unicode} + @param remote_agent: information about the remote agent that is to be called. + @type remote_agent: C{dict} """ - return call_broker_agent(username, mode='getservers') + if query_mode == 'LOCAL': + return call_local_broker_agent(username, mode='getservers') + else: + return call_local_broker_agent(username, mode='getservers', remote_agent=remote_agent) diff --git a/x2gobroker/brokers/base_broker.py b/x2gobroker/brokers/base_broker.py index be8b4e8..13235cb 100644 --- a/x2gobroker/brokers/base_broker.py +++ b/x2gobroker/brokers/base_broker.py @@ -289,7 +289,6 @@ class X2GoBroker(object): _acls_clients_allow = copy.deepcopy(_acls[u'acl-clients-allow']) _acls_clients_deny = copy.deepcopy(_acls[u'acl-clients-deny']) - _addr = self.get_client_address() _allow_client = False _deny_client = False @@ -421,10 +420,31 @@ class X2GoBroker(object): if self.config.has_value(self.backend_name, 'auth-mech'): _auth_mech = self.config.get_value(self.backend_name, 'auth-mech').lower() - logger_broker.debug('base_broker.X2GoBroker.get_authentication_mechanism(): found auth-mech in backend config section »{backend}«: {value}'.format(backend=self.backend_name, value=_auth_mech)) + logger_broker.debug('base_broker.X2GoBroker.get_authentication_mechanism(): found auth-mech in backend config section »{backend}«: {value}. This one has precendence over the default value.'.format(backend=self.backend_name, value=_auth_mech)) return unicode(_auth_mech) or unicode(_default_auth_mech) + def get_agent_query_mode(self): + """\ + Get the agent query mode (LOCAL or SSH, normally) that is configured for this + X2Go Session Broker instance. + + @return: agent query mode + @rtype: C{unicode} + + """ + _default_agent_query_mode = "LOCAL" + _agent_query_mode = "" + if self.config.has_value('global', 'default-agent-query-mode'): + _default_agent_query_mode = self.config.get_value('global', 'default-agent-query-mode').lower() + logger_broker.debug('base_broker.X2GoBroker.get_agent_query_mode(): found default-agent-query-mode in global config section: {value}'.format(value=_default_agent_query_mode)) + + if self.config.has_value(self.backend_name, 'agent-query-mode'): + _agent_query_mode = self.config.get_value(self.backend_name, 'agent-query-mode').lower() + logger_broker.debug('base_broker.X2GoBroker.get_agent_query_mode(): found agent-query-mode in backend config section »{backend}«: {value}. This one has precendence over the default value.'.format(backend=self.backend_name, value=_agent_query_mode)) + + return unicode(_agent_query_mode) or unicode(_default_agent_query_mode) + def get_userdb_service(self): """\ Get the name of the backend being used for retrieving user information from the @@ -694,7 +714,7 @@ class X2GoBroker(object): return list_of_profiles - def select_session(self, profile_id, username=None): + def select_session(self, profile_id, username): """\ Start/resume a session by selecting a profile name offered by the X2Go client. @@ -711,11 +731,29 @@ class X2GoBroker(object): # if we have more than one server, pick one server randomly for X2Go Broker Agent queries server_list = profile[u'host'] - random.shuffle(server_list) - agent_query_server = server_list[0] + agent_query_mode = self.get_agent_query_mode() if len(server_list) >= 2: - best_server = x2gobroker.agent.find_best_server() + + remote_agent = None + if agent_query_mode == 'SSH': + random.shuffle(server_list) + remote_agent_server = server_list[0] + remote_agent_port = profile[u'sshport'] + remote_agent = {u'hostname': remote_agent_server, u'port': remote_agent_port, } + + busy_servers = x2gobroker.agent.find_busy_servers(username=username, query_mode=agent_query_mode, remote_agent = remote_agent) + + for server in server_list: + if server not in busy_servers.keys(): + busy_servers[server] = 0 + + busy_server_list = [ (load, server) for server, load in busy_servers.items() ] + busy_server_list.sort() + print busy_server_list + + best_server = busy_server_list[0][1] + else: best_server = server_list[0] diff --git a/x2gobroker/brokers/ldap_broker.py b/x2gobroker/brokers/ldap_broker.py index 61857d8..8f631ab 100644 --- a/x2gobroker/brokers/ldap_broker.py +++ b/x2gobroker/brokers/ldap_broker.py @@ -25,7 +25,7 @@ L{ldap.X2GoBroker} class - a production X2GoBroker implementations that uses LDA __NAME__ = 'x2gobroker-pylib' # modules -import x2gobroker.base_broker as base +import x2gobroker.base class X2GoBroker(x2gobroker.base.X2GoBroker): """\ diff --git a/x2gobroker/defaults.py b/x2gobroker/defaults.py index 720fa94..e777142 100644 --- a/x2gobroker/defaults.py +++ b/x2gobroker/defaults.py @@ -109,6 +109,7 @@ X2GOBROKER_CONFIG_DEFAULTS = { u'default-user-db': u'libnss', u'default-group-db': u'libnss', u'ignore-primary-group-memberships': True, + u'default-agent-query-mode': u'LOCAL', }, 'zeroconf': { u'enable': True, @@ -135,6 +136,7 @@ X2GOBROKER_CONFIG_DEFAULTS = { u'host-search-filter': u'(&(objectClass=ipHost)(serial=X2GoServer)(cn=*))', u'group-search-filter': u'(&(objectClass=posifxGroup)(cn=*))', u'starttls': False, + u'agent-query-mode': u'SSH', }, } diff --git a/x2gobroker/web/json.py b/x2gobroker/web/json.py index b879b77..04743b5 100644 --- a/x2gobroker/web/json.py +++ b/x2gobroker/web/json.py @@ -21,7 +21,6 @@ # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. # modules -import web class X2GoBrokerWebJson: diff --git a/x2gobroker/web/plain.py b/x2gobroker/web/plain.py index 22b14ba..70ce4a6 100644 --- a/x2gobroker/web/plain.py +++ b/x2gobroker/web/plain.py @@ -60,7 +60,6 @@ class X2GoBrokerWebPlain: exec("import x2gobroker.brokers.{backend}_broker".format(backend=backend)) exec("broker_backend = x2gobroker.brokers.{backend}_broker.X2GoBroker()".format(backend=backend)) global_config = broker_backend.get_global_config() - backend_config = broker_backend.get_backend_config() # set the client address for the broker backend ip = web.ctx.env.get('HTTP_X_FORWARDED_FOR', web.ctx.get('ip', '')) hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-38-g769d5c1
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via 769d5c17f51f20e91f8bff1fb1830fba2ade4e05 (commit) from 9a385f3d881a59c8e589c3c373eeba8f66049d6e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 769d5c17f51f20e91f8bff1fb1830fba2ade4e05 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 11:21:03 2013 +0100 postinst/postrm scripts:The user x2gobroker is required by x2gobroker-agent and x2gobroker-daemon. So now both bin:packages provide that user account. ----------------------------------------------------------------------- Summary of changes: debian/changelog | 3 +++ debian/x2gobroker-agent.postrm | 10 ++++++---- ...r-agent.postinst => x2gobroker-daemon.postinst} | 7 +------ ...-x2gobroker.postrm => x2gobroker-daemon.postrm} | 10 +++++++--- 4 files changed, 17 insertions(+), 13 deletions(-) copy debian/{x2gobroker-agent.postinst => x2gobroker-daemon.postinst} (84%) copy debian/{python-x2gobroker.postrm => x2gobroker-daemon.postrm} (69%) The diff of changes is: diff --git a/debian/changelog b/debian/changelog index ebbbbd3..a44162f 100644 --- a/debian/changelog +++ b/debian/changelog @@ -19,6 +19,9 @@ x2gobroker (0.0.0.2-0~x2go1) UNRELEASED; urgency=low + Add bin:package x2gobroker-agent. * /debian/x2gobroker-daemon.init: + Handle stale PID file and already running daemon. + * postinst/postrm scripts: + + The user x2gobroker is required by x2gobroker-agent and x2gobroker-daemon. + So now both bin:packages provide that user account. -- Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Wed, 13 Feb 2013 12:03:25 +0100 diff --git a/debian/x2gobroker-agent.postrm b/debian/x2gobroker-agent.postrm index d703d32..e96ebe8 100755 --- a/debian/x2gobroker-agent.postrm +++ b/debian/x2gobroker-agent.postrm @@ -22,10 +22,12 @@ case "$1" in dpkg-statoverride --remove /usr/lib/x2go/x2gobroker-agent fi - # remove user/group x2gobroker from system - getent passwd x2gobroker >/dev/null && deluser x2gobroker - getent group x2gobroker >/dev/null && delgroup x2gobroker - getent group x2gobroker >/dev/null && delgroup x2gobroker + if [ ! -d /usr/share/doc/x2gobroker-daemon ]; then + # remove user/group x2gobroker from system (if not in use by x2gobroker-daemon + getent passwd x2gobroker >/dev/null && deluser x2gobroker + getent group x2gobroker >/dev/null && delgroup x2gobroker + getent group x2gobroker >/dev/null && delgroup x2gobroker + fi ;; remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear) diff --git a/debian/x2gobroker-agent.postinst b/debian/x2gobroker-daemon.postinst similarity index 84% copy from debian/x2gobroker-agent.postinst copy to debian/x2gobroker-daemon.postinst index 95faece..fca14ca 100755 --- a/debian/x2gobroker-agent.postinst +++ b/debian/x2gobroker-daemon.postinst @@ -1,5 +1,5 @@ #!/bin/sh -# postinst script for x2gobroker-agent +# postinst script for x2gobroker-daemon # # see: dh_installdeb(1) @@ -40,11 +40,6 @@ case "$1" in echo "User x2gobroker already exists." >&2 fi - # the x2gobroker-agent has to be installed setuid root - if ! dpkg-statoverride --list /usr/lib/x2go/x2gobroker-agent >/dev/null; then - dpkg-statoverride --add --update root x2gobroker 4750 /usr/lib/x2go/x2gobroker-agent - fi - ;; abort-upgrade|abort-remove|abort-deconfigure) diff --git a/debian/python-x2gobroker.postrm b/debian/x2gobroker-daemon.postrm similarity index 69% copy from debian/python-x2gobroker.postrm copy to debian/x2gobroker-daemon.postrm index 22abe93..678bbb9 100755 --- a/debian/python-x2gobroker.postrm +++ b/debian/x2gobroker-daemon.postrm @@ -1,5 +1,5 @@ #! /bin/sh -# postrm script for x2gobroker-agent +# postrm script for x2gobroker-daemon # # see: dh_installdeb(1) # summary of how this script can be called: @@ -18,8 +18,12 @@ set -e case "$1" in purge) - if dpkg-statoverride --list /var/log/x2gobroker >/dev/null; then - dpkg-statoverride --remove /var/log/x2gobroker + + if [ ! -d /usr/share/doc/x2gobroker-agent ]; then + # remove user/group x2gobroker from system (only if not in use by x2gobroker-agent + getent passwd x2gobroker >/dev/null && deluser x2gobroker + getent group x2gobroker >/dev/null && delgroup x2gobroker + getent group x2gobroker >/dev/null && delgroup x2gobroker fi ;; hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-37-g9a385f3
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via 9a385f3d881a59c8e589c3c373eeba8f66049d6e (commit) from fbb1f8755341c5f318b3e3ee2602487005612e4e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9a385f3d881a59c8e589c3c373eeba8f66049d6e Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 11:13:15 2013 +0100 follow-up for last commit: complete the service separation of x2gobroker-daemon and x2gobroker-authservice ----------------------------------------------------------------------- Summary of changes: debian/control | 1 + debian/python-x2gobroker.default | 29 +++++++++++++++++++++++++++ debian/x2gobroker-authservice.default | 9 --------- debian/x2gobroker-authservice.init | 11 +++++++---- debian/x2gobroker-daemon.default | 35 --------------------------------- debian/x2gobroker-daemon.init | 18 +++++++++++++---- sbin/x2gobroker | 30 +++++++++++++++++++++++++++- sbin/x2gobroker-authservice | 24 ++++++++++++++++++++-- setup.py | 7 +++++-- x2gobroker/__init__.py | 5 ++--- x2gobroker/authservice.py | 4 ++-- x2gobroker/defaults.py | 25 ----------------------- 12 files changed, 111 insertions(+), 87 deletions(-) create mode 100644 debian/python-x2gobroker.default The diff of changes is: diff --git a/debian/control b/debian/control index 4a7be0d..833c10f 100644 --- a/debian/control +++ b/debian/control @@ -22,6 +22,7 @@ Depends: python, python-argparse, python-setproctitle, + python-webpy (>= 1:0.37), python-x2gobroker (>= ${source:Version}), python-x2gobroker (<< ${source:Version}.1~), Suggests: apache2 | httpd, diff --git a/debian/python-x2gobroker.default b/debian/python-x2gobroker.default new file mode 100644 index 0000000..f34e313 --- /dev/null +++ b/debian/python-x2gobroker.default @@ -0,0 +1,29 @@ +# X2Go Broker Session Broker (common) configuration for Debian + +# The posix user/group ID the broker runs under (do not change!) +# if you change those nonetheless, make sure that the log file +# directory (default: /var/log/x2gobroker) and files in there are +# writable by that user +#X2GOBROKER_DAEMON_USER=x2gobroker +#X2GOBROKER_DAEMON_GROUP=x2gobroker + +# Run X2Go Session Broker in debug mode, this will make the broker +# available through http GET method calls (otherwise: POST method +# only) and you will be able to test the broker through your web +# browser (0=disable, 1=enable). +#X2GOBROKER_DEBUG=0 + +# Default X2Go Session Broker backend (available: zeroconf, inifile) +#X2GOBROKER_DEFAULT_BACKEND=zeroconf + +# Path to the X2Go Session Broker's configuration file +#X2GOBROKER_CONFIG=/etc/x2go/x2gobroker.conf + +# Path to the X2Go Session Broker's session profiles file (when using the inifile backend) +#X2GOBROKER_SESSIONPROFILES=/etc/x2go/broker/x2gobroker-sessionprofiles.conf + +# Path to the X2Go Session Broker's agent command +#X2GOBROKER_AGENT_CMD=/usr/lib/x2go/x2gobroker-agent + +# The unix socket file for communication between the broker and the authentication service. +#X2GOBROKER_AUTHSERVICE_SOCKET=/run/x2gobroker/x2gobroker-authservice.socket diff --git a/debian/x2gobroker-authservice.default b/debian/x2gobroker-authservice.default index 9f89cd4..017b75c 100644 --- a/debian/x2gobroker-authservice.default +++ b/debian/x2gobroker-authservice.default @@ -8,12 +8,3 @@ # you can disable the authentication service here. START_AUTHSERVICE=true -# The posix user ID the broker runs under (do not change!) -# if you change it nonetheless, make sure that the log file -# directory (default: /var/log/x2gobroker) and files in there are -# writable by that user -#X2GOBROKER_DAEMON_GROUP=x2gobroker - -# The unix socket file for communication between the broker and the authentication service. -#X2GOBROKER_AUTHSERVICE_SOCKET=/run/x2gobroker/x2gobroker-authservice.socket - diff --git a/debian/x2gobroker-authservice.init b/debian/x2gobroker-authservice.init index ccbad0a..d531f78 100755 --- a/debian/x2gobroker-authservice.init +++ b/debian/x2gobroker-authservice.init @@ -21,16 +21,18 @@ set -eu AUTHSERVICE=/usr/sbin/x2gobroker-authservice test -d /run && RUNDIR=/run || RUNDIR=/var/run PIDFILE_AUTHSERVICE=$RUNDIR/x2gobroker/x2gobroker-authservice.pid -DEBIANCONFIG=/etc/default/x2gobroker-authservice +DEBIANCONFIG_COMMON=/etc/default/python-x2gobroker +DEBIANCONFIG_AUTHSERVICE=/etc/default/x2gobroker-authservice test -x "$AUTHSERVICE" || exit 0 START_AUTHSERVICE=false +X2GOBROKER_DEBUG=0 X2GOBROKER_DAEMON_USER='x2gobroker' X2GOBROKER_DAEMON_GROUP='x2gobroker' X2GOBROKER_AUTHSERVICE_SOCKET="$RUNDIR/x2gobroker/x2gobroker-authservice.socket" -test -f $DEBIANCONFIG && . $DEBIANCONFIG - +test -f $DEBIANCONFIG_COMMON && . $DEBIANCONFIG_COMMON +test -f $DEBIANCONFIG_AUTHSERVICE && . $DEBIANCONFIG_AUTHSERVICE if ! getent passwd $X2GOBROKER_DAEMON_USER 1>/dev/null 2>/dev/null; then X2GOBROKER_DAEMON_USER=nobody @@ -42,8 +44,9 @@ fi # create PID directory mkdir -p $RUNDIR/x2gobroker chown $X2GOBROKER_DAEMON_USER:$X2GOBROKER_DAEMON_GROUP $RUNDIR/x2gobroker -chmod 0700 $RUNDIR/x2gobroker +chmod 0770 $RUNDIR/x2gobroker +export X2GOBROKER_DEBUG export X2GOBROKER_DAEMON_USER export X2GOBROKER_DAEMON_GROUP export X2GOBROKER_AUTHSERVICE_SOCKET diff --git a/debian/x2gobroker-daemon.default b/debian/x2gobroker-daemon.default index f3c5bc0..bff0410 100644 --- a/debian/x2gobroker-daemon.default +++ b/debian/x2gobroker-daemon.default @@ -3,44 +3,9 @@ # Uncomment to enable the X2Go Session Broker standalone daemon START_BROKER=true -# For PAM authentication the X2Go Session Broker needs its authentication -# service. The session broker itself runs as a non-privileged user (see below) -# whereas the authentication service must run as super-user root. -# -# If you do not use PAM as authentication mechanism with the X2Go Session Broker, -# you can disable the authentication service here. -START_AUTHSERVICE=true - -# The posix user ID the broker runs under (do not change!) -# if you change it nonetheless, make sure that the log file -# directory (default: /var/log/x2gobroker) and files in there are -# writable by that user -#X2GOBROKER_DAEMON_USER=x2gobroker - -# Run X2Go Session Broker in debug mode, this will make the broker -# available through http GET method calls (otherwise: POST method -# only) and you will be able to test the broker through your web -# browser (0=disable, 1=enable). -#X2GOBROKER_DEBUG=0 - # Bind standalone daemon to this address:port #DAEMON_BIND_ADDRESS=127.0.0.1:8080 -# Default X2Go Session Broker backend (available: zeroconf, inifile) -#X2GOBROKER_DEFAULT_BACKEND=zeroconf - -# Path to the X2Go Session Broker's configuration file -#X2GOBROKER_CONFIG=/etc/x2go/x2gobroker.conf - -# Path to the X2Go Session Broker's session profiles file (when using the inifile backend) -#X2GOBROKER_SESSIONPROFILES=/etc/x2go/broker/x2gobroker-sessionprofiles.conf - -# Path to the X2Go Session Broker's agent command -#X2GOBROKER_AGENT_CMD=/usr/lib/x2go/x2gobroker-agent - -# The unix socket file for communication between the broker and the authentication service. -#X2GOBROKER_AUTHSERVICE_SOCKET=/run/x2gobroker/x2gobroker-authservice.socket - ########################################################## ### ### diff --git a/debian/x2gobroker-daemon.init b/debian/x2gobroker-daemon.init index a632a86..0a8b90a 100755 --- a/debian/x2gobroker-daemon.init +++ b/debian/x2gobroker-daemon.init @@ -21,8 +21,8 @@ set -eu DAEMON=/usr/sbin/x2gobroker test -d /run && RUNDIR=/run || RUNDIR=/var/run PIDFILE_BROKER=$RUNDIR/x2gobroker/x2gobroker-daemon.pid -DEBIANCONFIG=/etc/default/x2gobroker-daemon -DEBIANCONFIG_AUTHSERVICE=/etc/default/x2gobroker-daemon +DEBIANCONFIG_COMMON=/etc/default/python-x2gobroker +DEBIANCONFIG_DAEMON=/etc/default/x2gobroker-daemon test -x "$DAEMON" || exit 0 @@ -30,6 +30,7 @@ START_BROKER=false DAEMON_BIND_ADDRESS=127.0.0.1:8080 X2GOBROKER_DEBUG=0 X2GOBROKER_DAEMON_USER='x2gobroker' +X2GOBROKER_DAEMON_GROUP='x2gobroker' X2GOBROKER_DEFAULT_BACKEND="zeroconf" X2GOBROKER_CONFIG="/etc/x2go/x2gobroker.conf" X2GOBROKER_SESSIONPROFILES="/etc/x2go/broker/x2gobroker-sessionprofiles.conf" @@ -37,12 +38,20 @@ X2GOBROKER_AGENT_CMD="/usr/lib/x2go/x2gobroker-agent" X2GOBROKER_AUTHSERVICE_SOCKET="$RUNDIR/x2gobroker/x2gobroker-authservice.socket" X2GOBROKER_SSL_CERTFILE= X2GOBROKER_SSL_KEYFILE= -test -f $DEBIANCONFIG && . $DEBIANCONFIG -test -f $DEBIANCONFIG_AUTHSERVICE && . $DEBIANCONFIG_AUTHSERVICE +test -f $DEBIANCONFIG_COMMON && . $DEBIANCONFIG_COMMON +test -f $DEBIANCONFIG_DAEMON && . $DEBIANCONFIG_DAEMON if ! getent passwd $X2GOBROKER_DAEMON_USER 1>/dev/null 2>/dev/null; then X2GOBROKER_DAEMON_USER=nobody fi +if ! getent group $X2GOBROKER_DAEMON_GROUP 1>/dev/null 2>/dev/null; then + X2GOBROKER_DAEMON_GROUP=nogroup +fi + +# create PID directory +mkdir -p $RUNDIR/x2gobroker +chown $X2GOBROKER_DAEMON_USER:$X2GOBROKER_DAEMON_GROUP $RUNDIR/x2gobroker +chmod 0770 $RUNDIR/x2gobroker # mend user ID variables when --chuid $X2GOBROKER_DAEMON_USER is used with start-stop-daemon export LOGNAME=$X2GOBROKER_DAEMON_USER @@ -51,6 +60,7 @@ export USERNAME=$X2GOBROKER_DAEMON_USER export X2GOBROKER_DEBUG export X2GOBROKER_DAEMON_USER +export X2GOBROKER_DAEMON_GROUP export X2GOBROKER_CONFIG export X2GOBROKER_DEFAULT_BACKEND export X2GOBROKER_SESSIONPROFILES diff --git a/sbin/x2gobroker b/sbin/x2gobroker index bb52019..33e9580 100755 --- a/sbin/x2gobroker +++ b/sbin/x2gobroker @@ -22,10 +22,11 @@ # Free Software Foundation, Inc., # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. -import sys import os +import sys import argparse import socket +import logging import web from web.wsgiserver import CherryPyWSGIServer @@ -35,8 +36,35 @@ except ImportError: sys.path.insert(0, os.path.join(os.getcwd(), '..')) import x2gobroker.defaults +from x2gobroker import __VERSION__ +from x2gobroker import __AUTHOR__ from x2gobroker.loggers import logger_broker, logger_access, logger_error +logger_broker.info('X2Go Session Broker ({version}), written by {author}'.format(version=__VERSION__, author=__AUTHOR__)) +logger_broker.info('Setting up the broker\'s environment...') +logger_broker.info(' X2GOBROKER_DEBUG: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_DEBUG)) +logger_broker.info(' X2GOBROKER_CONFIG: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_CONFIG)) +logger_broker.info(' X2GOBROKER_AGENT_CMD: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_AGENT_CMD)) +logger_broker.info(' X2GOBROKER_AUTHSERVICE_SOCKET: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET)) +logger_broker.info(' X2GOBROKER_DEFAULT_BACKEND: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_DEFAULT_BACKEND)) +logger_broker.info(' X2GOBROKER_SSL_CERTFILE: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_SSL_CERTFILE)) +logger_broker.info(' X2GOBROKER_SSL_KEYFILE: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_SSL_KEYFILE)) + +# raise log level to DEBUG if requested... +if x2gobroker.defaults.X2GOBROKER_DEBUG and not x2gobroker.defaults.X2GOBROKER_TESTSUITE: + logger_broker.setLevel(logging.DEBUG) + logger_access.setLevel(logging.DEBUG) + logger_error.setLevel(logging.DEBUG) + +# check effective UID the broker runs as and complain appropriately... +if x2gobroker.defaults.X2GOBROKER_USER != x2gobroker.defaults.X2GOBROKER_DAEMON_USER and os.geteuid() != 0: + logger_broker.warn('X2Go Session Broker has been started interactively by user {username}, better run as user {daemon_username}.'.format(username=X2GOBROKER_USER, daemon_username=X2GOBROKER_DAEMON_USER)) + logger_broker.info('Automatically switching to DEBUG mode due to interactive launch of this application.') +elif x2gobroker.defaults.X2GOBROKER_DAEMON_USER != 'root' and os.geteuid() == 0: + logger_broker.warn('X2Go Session Broker should not be run as root, better run as user {daemon_username}.'.format(daemon_username=X2GOBROKER_DAEMON_USER)) +elif os.geteuid() == 0: + logger_broker.warn('X2Go Session Broker should not be run as root, better run as non-privileged user') + # parse-in potential command line options cmdline_args = None if __name__ == "__main__": diff --git a/sbin/x2gobroker-authservice b/sbin/x2gobroker-authservice index 6ff6423..2d9af94 100755 --- a/sbin/x2gobroker-authservice +++ b/sbin/x2gobroker-authservice @@ -26,17 +26,37 @@ import os import sys import setproctitle import argparse +import logging try: - import x2gobroker.authservice + import x2gobroker.defaults except ImportError: sys.path.insert(0, os.path.join(os.getcwd(), '..')) - import x2gobroker.authservice + import x2gobroker.defaults + +import x2gobroker.authservice PROG_NAME = os.path.basename(sys.argv[0]) PROG_OPTIONS = sys.argv[1:] setproctitle.setproctitle("%s %s" % (PROG_NAME, " ".join(PROG_OPTIONS))) +from x2gobroker import __VERSION__ +from x2gobroker import __AUTHOR__ +from x2gobroker.loggers import logger_authservice + +# raise log level to DEBUG if requested... +if x2gobroker.defaults.X2GOBROKER_DEBUG and not x2gobroker.defaults.X2GOBROKER_TESTSUITE: + logger_authservice.setLevel(logging.DEBUG) + +logger_authservice.info('X2Go Session Broker ({version}), written by {author}'.format(version=__VERSION__, author=__AUTHOR__)) +logger_authservice.info('Setting up the PAM authentication service\'s environment...') +logger_authservice.info(' X2GOBROKER_DEBUG: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_DEBUG)) +logger_authservice.info(' X2GOBROKER_AUTHSERVICE_SOCKET: {value}'.format(value=x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET)) + +# check effective UID the broker runs as and complain appropriately... +if os.geteuid() != 0: + logger_authservice.warn('X2Go Session Broker\'PAM authentication service should run with root privileges to guarantee proper access to all PAM modules.') + if __name__ == '__main__': common_options = [ diff --git a/setup.py b/setup.py index 8745c3f..f6d9aba 100755 --- a/setup.py +++ b/setup.py @@ -28,15 +28,18 @@ import os for line in file(os.path.join('x2gobroker', '__init__.py')).readlines(): if (line.startswith('__VERSION__')): exec(line.strip()) +for line in file(os.path.join('x2gobroker', '__init__.py')).readlines(): + if (line.startswith('__AUTHOR__')): + exec(line.strip()) MODULE_VERSION = __VERSION__ - +MODULE_AUTHOR = __AUTHOR__ setup( name = "x2gobroker", version = MODULE_VERSION, description = "X2Go Session Broker", license = 'AGPLv3+', - author = 'Mike Gabriel', + author = MODULE_AUTHOR, url = 'http://www.x2go.org', packages = find_packages('.'), package_dir = {'': '.'}, diff --git a/x2gobroker/__init__.py b/x2gobroker/__init__.py index ad8c1e4..d9172cc 100644 --- a/x2gobroker/__init__.py +++ b/x2gobroker/__init__.py @@ -18,6 +18,5 @@ # Free Software Foundation, Inc., # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. -__VERSION__ = '0.0.0.1' - - +__VERSION__ = '0.0.0.2' +__AUTHOR__ = 'Mike Gabriel (X2Go Project) <mike.gabriel(a)das-netzwerkteam.de>' diff --git a/x2gobroker/authservice.py b/x2gobroker/authservice.py index 7b12bb9..fa7ce84 100644 --- a/x2gobroker/authservice.py +++ b/x2gobroker/authservice.py @@ -93,7 +93,7 @@ def authenticate(username, password, service="x2gobroker"): result = s.recv(1024) s.close() if result.startswith('ok'): - logger_authservice.info('authentication against PAM service {service} succeeded for {username}'.format(username=username, service=service)) + logger_authservice.info('authentication against PAM service »{service}« succeeded for user »{username}«'.format(username=username, service=service)) return True - logger_authservice.info('authentication against service {service} failed for user {username}'.format(username=username, service=service)) + logger_authservice.info('authentication against service »{service}« failed for user »{username}«'.format(username=username, service=service)) return False diff --git a/x2gobroker/defaults.py b/x2gobroker/defaults.py index f56a566..720fa94 100644 --- a/x2gobroker/defaults.py +++ b/x2gobroker/defaults.py @@ -46,36 +46,16 @@ else: if X2GOBROKER_USER != X2GOBROKER_DAEMON_USER: X2GOBROKER_DEBUG = True -# raise log level to DEBUG if requested... -if X2GOBROKER_DEBUG and not X2GOBROKER_TESTSUITE: - logger_broker.setLevel(logging.DEBUG) - logger_access.setLevel(logging.DEBUG) - logger_error.setLevel(logging.DEBUG) - # drop og level to CRITICAL if we are running the unittests... if X2GOBROKER_TESTSUITE: logger_broker.setLevel(logging.CRITICAL) logger_access.setLevel(logging.CRITICAL) logger_error.setLevel(logging.CRITICAL) -# check effective UID the broker runs as and complain appropriately... -if X2GOBROKER_USER != X2GOBROKER_DAEMON_USER and os.geteuid() != 0: - logger_broker.warn('X2Go Session Broker has been started interactively by user {username}, better run as user {daemon_username}.'.format(username=X2GOBROKER_USER, daemon_username=X2GOBROKER_DAEMON_USER)) - logger_broker.info('Automatically switching to DEBUG mode due to interactive launch of this application.') -elif X2GOBROKER_DAEMON_USER != 'root' and os.geteuid() == 0: - logger_broker.warn('X2Go Session Broker should not be run as root, better run as user {daemon_username}.'.format(daemon_username=X2GOBROKER_DAEMON_USER)) -elif os.geteuid() == 0: - logger_broker.warn('X2Go Session Broker should not be run as root, better run as non-privileged user') - -logger_broker.info('Setting up the broker\'s environment...') -logger_broker.info('X2Go Session Broker: Setting up the broker\'s environment...') -logger_broker.info(' X2GOBROKER_DEBUG: {value}'.format(value=X2GOBROKER_DEBUG)) - if os.environ.has_key('X2GOBROKER_CONFIG'): X2GOBROKER_CONFIG = os.environ['X2GOBROKER_CONFIG'] else: X2GOBROKER_CONFIG = "/etc/x2go/x2gobroker.conf" -logger_broker.info(' X2GOBROKER_CONFIG: {value}'.format(value=X2GOBROKER_CONFIG)) X2GOBROKER_SESSIONPROFILES = "/etc/x2go/broker/x2gobroker-sessionprofiles.conf" @@ -83,31 +63,26 @@ if os.environ.has_key('X2GOBROKER_AGENT_CMD'): X2GOBROKER_AGENT_CMD = os.environ['X2GOBROKER_AGENT_CMD'] else: X2GOBROKER_AGENT_CMD = "/usr/lib/x2go/x2gobroker-agent" -logger_broker.info(' X2GOBROKER_AGENT_CMD: {value}'.format(value=X2GOBROKER_AGENT_CMD)) if os.environ.has_key('X2GOBROKER_AUTHSERVICE_SOCKET'): X2GOBROKER_AUTHSERVICE_SOCKET=os.environ['X2GOBROKER_AUTHSERVICE_SOCKET'] else: X2GOBROKER_AUTHSERVICE_SOCKET="/var/run/x2gobroker-authservice.socket" -logger_broker.info(' X2GOBROKER_AUTHSERVICE_SOCKET: {value}'.format(value=X2GOBROKER_AUTHSERVICE_SOCKET)) if os.environ.has_key('X2GOBROKER_DEFAULT_BACKEND'): X2GOBROKER_DEFAULT_BACKEND = os.environ['X2GOBROKER_DEFAULT_BACKEND'] else: X2GOBROKER_DEFAULT_BACKEND = "zeroconf" -logger_broker.info(' X2GOBROKER_DEFAULT_BACKEND: {value}'.format(value=X2GOBROKER_DEFAULT_BACKEND)) if os.environ.has_key('X2GOBROKER_SSL_CERTFILE'): X2GOBROKER_SSL_CERTFILE = os.environ['X2GOBROKER_SSL_CERTFILE'] else: X2GOBROKER_SSL_CERTFILE = "" -logger_broker.info(' X2GOBROKER_SSL_CERTFILE: {value}'.format(value=X2GOBROKER_SSL_CERTFILE)) if os.environ.has_key('X2GOBROKER_SSL_KEYFILE'): X2GOBROKER_SSL_KEYFILE = os.environ['X2GOBROKER_SSL_KEYFILE'] else: X2GOBROKER_SSL_KEYFILE = "" -logger_broker.info(' X2GOBROKER_SSL_KEYFILE: {value}'.format(value=X2GOBROKER_SSL_KEYFILE)) ### hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-36-gfbb1f87
by git-admin＠x2go.org 20 Feb '13

20 Feb '13

The branch, master has been updated via fbb1f8755341c5f318b3e3ee2602487005612e4e (commit) from d9c17a236357d7939415afae5b420917f0e2f212 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fbb1f8755341c5f318b3e3ee2602487005612e4e Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 20 01:17:32 2013 +0100 separate x2gobroker-daemon and x2gobroker-authservice into two separate packages ----------------------------------------------------------------------- Summary of changes: debian/control | 37 +++++++++++- debian/x2gobroker-authservice.default | 19 ++++++ debian/x2gobroker-authservice.init | 102 ++++++++++++++++++++++++++++++++ debian/x2gobroker-authservice.install | 1 + debian/x2gobroker-authservice.manpages | 1 + debian/x2gobroker-daemon.init | 36 ++--------- debian/x2gobroker.install | 1 - etc/broker/x2gobroker-loggers.conf | 23 ++++++- sbin/x2gobroker-authservice | 14 ++--- x2gobroker/authservice.py | 23 +++++-- x2gobroker/defaults.py | 1 + x2gobroker/loggers.py | 5 ++ 12 files changed, 215 insertions(+), 48 deletions(-) create mode 100644 debian/x2gobroker-authservice.default create mode 100755 debian/x2gobroker-authservice.init create mode 100644 debian/x2gobroker-authservice.install create mode 100644 debian/x2gobroker-authservice.manpages The diff of changes is: diff --git a/debian/control b/debian/control index 3b222bc..4a7be0d 100644 --- a/debian/control +++ b/debian/control @@ -20,8 +20,9 @@ Depends: ${misc:Depends}, ${python:Depends}, python, - python-x2gobroker (>= ${source:Version}), python-x2gobroker (<< ${source:Version}.1~), + python-argparse, python-setproctitle, + python-x2gobroker (>= ${source:Version}), python-x2gobroker (<< ${source:Version}.1~), Suggests: apache2 | httpd, Description: X2Go http(s) based session broker (executable) @@ -45,12 +46,46 @@ Description: X2Go http(s) based session broker (executable) . This package contains the x2gobroker executable. +Package: x2gobroker-authservice +Architecture: all +Depends: + python, + python-argparse, + python-setproctitle, + ${misc:Depends}, + ${python:Depends}, +Suggests: + apache2 | httpd, +Description: X2Go http(s) based session broker (PAM authentication service) + X2Go is a server based computing environment with + - session resuming + - low bandwidth support + - LDAP support + - client side mass storage mounting support + - client side printing support + - audio support + - authentication by smartcard and USB stick + . + The session broker is a server tool for X2Go that + tells your X2Go Client application in a terminal + server cluster what servers and session types are + most appropriate for the user in front of the + X2Go terminal. + . + A session broker is most useful in load balanced + X2Go server farms. + . + This package contains the authentication service + against the PAM system. + Package: x2gobroker-daemon Architecture: all Depends: ${misc:Depends}, ${python:Depends}, x2gobroker (>= ${source:Version}), x2gobroker (<< ${source:Version}.1~), +Recommends: + x2gobroker-authservice, Suggests: apache2 | httpd, Description: X2Go http(s) based session broker (daemon) diff --git a/debian/x2gobroker-authservice.default b/debian/x2gobroker-authservice.default new file mode 100644 index 0000000..9f89cd4 --- /dev/null +++ b/debian/x2gobroker-authservice.default @@ -0,0 +1,19 @@ +# X2Go Session Broker (PAM Authentication Service) configuration for Debian + +# For PAM authentication the X2Go Session Broker needs its authentication +# service. The session broker itself runs as a non-privileged user (see below) +# whereas the authentication service must run as super-user root. +# +# If you do not use PAM as authentication mechanism with the X2Go Session Broker, +# you can disable the authentication service here. +START_AUTHSERVICE=true + +# The posix user ID the broker runs under (do not change!) +# if you change it nonetheless, make sure that the log file +# directory (default: /var/log/x2gobroker) and files in there are +# writable by that user +#X2GOBROKER_DAEMON_GROUP=x2gobroker + +# The unix socket file for communication between the broker and the authentication service. +#X2GOBROKER_AUTHSERVICE_SOCKET=/run/x2gobroker/x2gobroker-authservice.socket + diff --git a/debian/x2gobroker-authservice.init b/debian/x2gobroker-authservice.init new file mode 100755 index 0000000..ccbad0a --- /dev/null +++ b/debian/x2gobroker-authservice.init @@ -0,0 +1,102 @@ +#!/bin/sh +# +# Start the X2Go Session Broker PAM Authentication Service +# +# Copyright © 2012 Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> +# Distributable under the terms of the GNU AGPL version 2. +# +### BEGIN INIT INFO +# Provides: x2gobroker-authservice +# Required-Start: $remote_fs $syslog +# Required-Stop: $remote_fs $syslog +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: X2Go Session Broker PAM Authentication Service +# Description: PAM authentication service for X2Go Session Broker +### END INIT INFO +# + +set -eu + +AUTHSERVICE=/usr/sbin/x2gobroker-authservice +test -d /run && RUNDIR=/run || RUNDIR=/var/run +PIDFILE_AUTHSERVICE=$RUNDIR/x2gobroker/x2gobroker-authservice.pid +DEBIANCONFIG=/etc/default/x2gobroker-authservice + +test -x "$AUTHSERVICE" || exit 0 + +START_AUTHSERVICE=false +X2GOBROKER_DAEMON_USER='x2gobroker' +X2GOBROKER_DAEMON_GROUP='x2gobroker' +X2GOBROKER_AUTHSERVICE_SOCKET="$RUNDIR/x2gobroker/x2gobroker-authservice.socket" +test -f $DEBIANCONFIG && . $DEBIANCONFIG + + +if ! getent passwd $X2GOBROKER_DAEMON_USER 1>/dev/null 2>/dev/null; then + X2GOBROKER_DAEMON_USER=nobody +fi +if ! getent group $X2GOBROKER_DAEMON_GROUP 1>/dev/null 2>/dev/null; then + X2GOBROKER_DAEMON_USER=nogroup +fi + +# create PID directory +mkdir -p $RUNDIR/x2gobroker +chown $X2GOBROKER_DAEMON_USER:$X2GOBROKER_DAEMON_GROUP $RUNDIR/x2gobroker +chmod 0700 $RUNDIR/x2gobroker + +export X2GOBROKER_DAEMON_USER +export X2GOBROKER_DAEMON_GROUP +export X2GOBROKER_AUTHSERVICE_SOCKET + +. /lib/lsb/init-functions + +is_true() +{ + case "${1:-}" in + [Yy]es|[Yy]|1|[Tt]|[Tt]rue) return 0;; + *) return 1; + esac +} + +case "${1:-}" in + start) + if [ -f $PIDFILE_AUTHSERVICE ]; then + if ps -u root | grep $(basename $AUTHSERVICE) 1>/dev/null 2>/dev/null; then + log_warning_msg "X2Go Broker Authentication Service already running" + else + log_warning_msg "X2Go Broker Authentication Service: stale PID file ($PIDFILE_AUTHSERVICE). Delete it manually!" + fi + START_AUTHSERVICE=no + fi + if is_true $START_AUTHSERVICE; then + set +e + # once we are here, we have to make sure the authservice.socket does not exist + rm -f $X2GOBROKER_AUTHSERVICE_SOCKET + # and now we can start the auth service + log_daemon_msg "Starting X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" + start-stop-daemon -b -m -S -p $PIDFILE_AUTHSERVICE -x $AUTHSERVICE -- -s $X2GOBROKER_AUTHSERVICE_SOCKET -o root -g $X2GOBROKER_DAEMON_GROUP -p 0660 + set -e + log_end_msg $? + fi + ;; + stop) + if [ -f $PIDFILE_AUTHSERVICE ] ; then + log_daemon_msg "X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" + set +e + start-stop-daemon -K -p $PIDFILE_AUTHSERVICE + rm -f $PIDFILE_AUTHSERVICE + log_end_msg $? + set -e + fi + ;; + restart|reload|force-reload) + ${0:-} stop + ${0:-} start + ;; + *) + echo "Usage: ${0:-} {start|stop|restart|reload|force-reload}" >&2 + exit 1 + ;; +esac + +exit 0 diff --git a/debian/x2gobroker-authservice.install b/debian/x2gobroker-authservice.install new file mode 100644 index 0000000..03fb37c --- /dev/null +++ b/debian/x2gobroker-authservice.install @@ -0,0 +1 @@ +sbin/x2gobroker-authservice usr/sbin/ \ No newline at end of file diff --git a/debian/x2gobroker-authservice.manpages b/debian/x2gobroker-authservice.manpages new file mode 100644 index 0000000..f32e545 --- /dev/null +++ b/debian/x2gobroker-authservice.manpages @@ -0,0 +1 @@ +#man/man8/x2gobroker-authservice.8 \ No newline at end of file diff --git a/debian/x2gobroker-daemon.init b/debian/x2gobroker-daemon.init index 67276e4..a632a86 100755 --- a/debian/x2gobroker-daemon.init +++ b/debian/x2gobroker-daemon.init @@ -7,7 +7,7 @@ # ### BEGIN INIT INFO # Provides: x2gobroker-daemon -# Required-Start: $remote_fs $syslog +# Required-Start: $remote_fs $syslog x2gobroker-authservice # Required-Stop: $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 @@ -19,16 +19,14 @@ set -eu DAEMON=/usr/sbin/x2gobroker -AUTHSERVICE=/usr/sbin/x2gobroker-authservice test -d /run && RUNDIR=/run || RUNDIR=/var/run PIDFILE_BROKER=$RUNDIR/x2gobroker/x2gobroker-daemon.pid -PIDFILE_AUTHSERVICE=$RUNDIR/x2gobroker/x2gobroker-authservice.pid DEBIANCONFIG=/etc/default/x2gobroker-daemon +DEBIANCONFIG_AUTHSERVICE=/etc/default/x2gobroker-daemon test -x "$DAEMON" || exit 0 START_BROKER=false -START_AUTHSERVICE=false DAEMON_BIND_ADDRESS=127.0.0.1:8080 X2GOBROKER_DEBUG=0 X2GOBROKER_DAEMON_USER='x2gobroker' @@ -40,16 +38,12 @@ X2GOBROKER_AUTHSERVICE_SOCKET="$RUNDIR/x2gobroker/x2gobroker-authservice.socket" X2GOBROKER_SSL_CERTFILE= X2GOBROKER_SSL_KEYFILE= test -f $DEBIANCONFIG && . $DEBIANCONFIG +test -f $DEBIANCONFIG_AUTHSERVICE && . $DEBIANCONFIG_AUTHSERVICE if ! getent passwd $X2GOBROKER_DAEMON_USER 1>/dev/null 2>/dev/null; then X2GOBROKER_DAEMON_USER=nobody fi -# create PID directory -mkdir -p $RUNDIR/x2gobroker -chown $X2GOBROKER_DAEMON_USER:nogroup $RUNDIR/x2gobroker -chmod 0700 $RUNDIR/x2gobroker - # mend user ID variables when --chuid $X2GOBROKER_DAEMON_USER is used with start-stop-daemon export LOGNAME=$X2GOBROKER_DAEMON_USER export USER=$X2GOBROKER_DAEMON_USER @@ -77,7 +71,7 @@ is_true() case "${1:-}" in start) - if [ -e $PIDFILE_BROKER ]; then + if [ -f $PIDFILE_BROKER ]; then if ps -u $X2GOBROKER_DAEMON_USER | grep $(basename $DAEMON) 1>/dev/null 2>/dev/null; then log_warning_msg "X2Go Session Broker already running" else @@ -91,20 +85,6 @@ case "${1:-}" in start-stop-daemon --chuid $X2GOBROKER_DAEMON_USER -b -m -S -p $PIDFILE_BROKER -x $DAEMON -- -b $DAEMON_BIND_ADDRESS log_end_msg $? set -e - if [ -e $PIDFILE_AUTHSERVICE ]; then - if ps -u root | grep $(basename $AUTHSERVICE) 1>/dev/null 2>/dev/null; then - log_warning_msg "X2Go Broker Authentication Service already running" - else - log_warning_msg "X2Go Broker Authentication Service: stale PID file ($PIDFILE_AUTHSERVICE). Delete it manually!" - fi - START_AUTHSERVICE=no - fi - if is_true $START_AUTHSERVICE; then - set +e - log_daemon_msg "Starting X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" - start-stop-daemon -b -m -S -p $PIDFILE_AUTHSERVICE -x $AUTHSERVICE -- -s $X2GOBROKER_AUTHSERVICE_SOCKET - set -e - fi fi ;; stop) @@ -116,14 +96,6 @@ case "${1:-}" in log_end_msg $? set -e fi - if [ -f $PIDFILE_AUTHSERVICE ] ; then - log_daemon_msg "X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" - set +e - start-stop-daemon -K -p $PIDFILE_AUTHSERVICE - rm -f $PIDFILE_AUTHSERVICE - log_end_msg $? - set -e - fi ;; restart|reload|force-reload) ${0:-} stop diff --git a/debian/x2gobroker.install b/debian/x2gobroker.install index 29dc1c0..fac20e4 100644 --- a/debian/x2gobroker.install +++ b/debian/x2gobroker.install @@ -1,2 +1 @@ sbin/x2gobroker usr/sbin/ -sbin/x2gobroker-authservice usr/sbin/ \ No newline at end of file diff --git a/etc/broker/x2gobroker-loggers.conf b/etc/broker/x2gobroker-loggers.conf index 36d5e3e..4c395a2 100644 --- a/etc/broker/x2gobroker-loggers.conf +++ b/etc/broker/x2gobroker-loggers.conf @@ -18,18 +18,20 @@ # Free Software Foundation, Inc., # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. +# WARNING: only modify this file if you _exactly_ know what you are doing!!! + [loggers] -keys=root,broker,access,error +keys=root,broker,authservice,access,error [logger_root] level=NOTSET handlers=stdoutHandler [handlers] -keys=stdoutHandler,brokerFileHandler,accessFileHandler,errorFileHandler +keys=stdoutHandler,brokerFileHandler,authserviceFileHandler,accessFileHandler,errorFileHandler [formatters] -keys=brokerFormatter,accessFormatter,errorFormatter +keys=brokerFormatter,authserviceFormatter,accessFormatter,errorFormatter [handler_stdoutHandler] class=StreamHandler @@ -50,6 +52,21 @@ args=('/var/log/x2gobroker/broker.log',) format=%(asctime)s - %(name)s - %(levelname)s - %(message)s datefmt= +[logger_authservice] +level=DEBUG +handlers=authserviceFileHandler +qualname=authservice +propagate=0 + +[handler_authserviceFileHandler] +class=FileHandler +formatter=authserviceFormatter +args=('/var/log/x2gobroker/authservice.log',) + +[formatter_authserviceFormatter] +format=%(asctime)s - %(name)s - %(levelname)s - %(message)s +datefmt= + [logger_access] level=DEBUG handlers=accessFileHandler diff --git a/sbin/x2gobroker-authservice b/sbin/x2gobroker-authservice index 12974f8..6ff6423 100755 --- a/sbin/x2gobroker-authservice +++ b/sbin/x2gobroker-authservice @@ -40,10 +40,13 @@ setproctitle.setproctitle("%s %s" % (PROG_NAME, " ".join(PROG_OPTIONS))) if __name__ == '__main__': common_options = [ - {'args':['-s','--socket-file'], 'default': x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET, 'metavar': 'AUTHSOCKET', 'help': 'socket file for AuthService communication', }, - {'args':['-d','--debug'], 'default': False, 'action': 'store_true', 'help': 'enable debugging code', }, + {'args':['-s','--socket-file'], 'default': x2gobroker.authservice.X2GOBROKER_AUTHSERVICE_SOCKET, 'metavar': 'AUTHSOCKET', 'help': 'socket file for AuthService communication', }, + {'args':['-o','--owner'], 'default': 'root', 'help': 'owner of the AuthService socket file', }, + {'args':['-g','--group'], 'default': 'root', 'help': 'group ownership of the AuthService socket file', }, + {'args':['-p','--permissions'], 'default': '0660', 'help': 'set these file permissions for the AuthService socket file', }, + ] - p = argparse.ArgumentParser(description='X2Go Session Broker (PAM Auth Service)',\ + p = argparse.ArgumentParser(description='X2Go Session Broker (PAM Authentication Service)',\ formatter_class=argparse.RawDescriptionHelpFormatter, \ add_help=True, argument_default=None) p_common = p.add_argument_group('common parameters') @@ -56,11 +59,8 @@ if __name__ == '__main__': cmdline_args = p.parse_args() - if cmdline_args.debug: - x2gobroker.defaults.X2GOBROKER_DEBUG = cmdline_args.debug - socket_file = cmdline_args.socket_file - x2gobroker.authservice.AuthService(socket_file) + x2gobroker.authservice.AuthService(socket_file, owner=cmdline_args.owner, group_owner=cmdline_args.group, permissions=cmdline_args.permissions) try: x2gobroker.authservice.loop() except KeyboardInterrupt: diff --git a/x2gobroker/authservice.py b/x2gobroker/authservice.py index 018be90..7b12bb9 100644 --- a/x2gobroker/authservice.py +++ b/x2gobroker/authservice.py @@ -20,11 +20,23 @@ # Free Software Foundation, Inc., # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. +import os import asyncore import pam import socket -import x2gobroker.defaults +from pwd import getpwnam +from grp import getgrnam + +from loggers import logger_authservice + +logger_authservice.info('X2Go Session Broker PAM Authentication Service: Setting up the broker\'s environment...') +if os.environ.has_key('X2GOBROKER_AUTHSERVICE_SOCKET'): + X2GOBROKER_AUTHSERVICE_SOCKET=os.environ['X2GOBROKER_AUTHSERVICE_SOCKET'] +else: + X2GOBROKER_AUTHSERVICE_SOCKET="/var/run/x2gobroker-authservice.socket" +logger_authservice.info(' X2GOBROKER_AUTHSERVICE_SOCKET: {value}'.format(value=X2GOBROKER_AUTHSERVICE_SOCKET)) + class AuthClient(asyncore.dispatcher_with_send): @@ -56,11 +68,13 @@ class AuthClient(asyncore.dispatcher_with_send): class AuthService(asyncore.dispatcher_with_send): - def __init__(self, socketfile): + def __init__(self, socketfile, owner='root', group_owner='root', permissions='0660'): asyncore.dispatcher_with_send.__init__(self) self.create_socket(socket.AF_UNIX, socket.SOCK_STREAM) self.set_reuse_addr() self.bind(socketfile) + os.chown(socketfile, getpwnam(owner).pw_uid, getgrnam(group_owner).gr_gid) + os.chmod(socketfile, int(permissions, 8)) self.listen(1) def handle_accept(self): @@ -74,11 +88,12 @@ def loop(): def authenticate(username, password, service="x2gobroker"): s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) - s.connect(x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET) - + s.connect(X2GOBROKER_AUTHSERVICE_SOCKET) s.send('{username} {password} {service}\n'.format(username=username, password=password, service=service)) result = s.recv(1024) s.close() if result.startswith('ok'): + logger_authservice.info('authentication against PAM service {service} succeeded for {username}'.format(username=username, service=service)) return True + logger_authservice.info('authentication against service {service} failed for user {username}'.format(username=username, service=service)) return False diff --git a/x2gobroker/defaults.py b/x2gobroker/defaults.py index c02ce43..f56a566 100644 --- a/x2gobroker/defaults.py +++ b/x2gobroker/defaults.py @@ -68,6 +68,7 @@ elif os.geteuid() == 0: logger_broker.warn('X2Go Session Broker should not be run as root, better run as non-privileged user') logger_broker.info('Setting up the broker\'s environment...') +logger_broker.info('X2Go Session Broker: Setting up the broker\'s environment...') logger_broker.info(' X2GOBROKER_DEBUG: {value}'.format(value=X2GOBROKER_DEBUG)) if os.environ.has_key('X2GOBROKER_CONFIG'): diff --git a/x2gobroker/loggers.py b/x2gobroker/loggers.py index 7791bbd..2dd9178 100644 --- a/x2gobroker/loggers.py +++ b/x2gobroker/loggers.py @@ -43,6 +43,7 @@ if getpass.getuser() == X2GOBROKER_DAEMON_USER: # create loggers logger_broker = logging.getLogger('broker') + logger_authservice = logging.getLogger('authservice') logger_access = logging.getLogger('access') logger_error = logging.getLogger('error') @@ -58,6 +59,10 @@ else: logger_broker.addHandler(stdout_handler) logger_broker.propagate = 0 + logger_authservice = logging.getLogger('authservice') + logger_authservice.addHandler(stdout_handler) + logger_authservice.propagate = 0 + logger_access = logging.getLogger('access') logger_access.addHandler(stdout_handler) logger_access.propagate = 0 hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

x2gobroker.git - master (branch) updated: 0.0.0.1-35-gd9c17a2
by git-admin＠x2go.org 19 Feb '13

19 Feb '13

The branch, master has been updated via d9c17a236357d7939415afae5b420917f0e2f212 (commit) via 176c5d672d301ed401172f23f5dac5d765d7f2f6 (commit) from bb450a2ea118c06895c26080e1a2fed06ceec5ae (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d9c17a236357d7939415afae5b420917f0e2f212 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Tue Feb 19 23:29:38 2013 +0100 Perform PAM authentication via an authentication service (the broker runs as non-privileged user, the authentication service as root). commit 176c5d672d301ed401172f23f5dac5d765d7f2f6 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Tue Feb 19 23:28:14 2013 +0100 add debug log messages, remember config file name as class property ----------------------------------------------------------------------- Summary of changes: debian/changelog | 2 + debian/x2gobroker-daemon.default | 28 ++++++++---- debian/x2gobroker-daemon.init | 51 ++++++++++++++++----- debian/x2gobroker.install | 1 + sbin/x2gobroker | 2 + sbin/x2gobroker-authservice | 67 +++++++++++++++++++++++++++ x2gobroker/authmechs/pam_authmech.py | 4 +- x2gobroker/authservice.py | 84 ++++++++++++++++++++++++++++++++++ x2gobroker/brokers/base_broker.py | 7 ++- x2gobroker/defaults.py | 6 +++ 10 files changed, 228 insertions(+), 24 deletions(-) create mode 100755 sbin/x2gobroker-authservice create mode 100644 x2gobroker/authservice.py The diff of changes is: diff --git a/debian/changelog b/debian/changelog index ad2e00c..ebbbbd3 100644 --- a/debian/changelog +++ b/debian/changelog @@ -13,6 +13,8 @@ x2gobroker (0.0.0.2-0~x2go1) UNRELEASED; urgency=low - Make sure the unprivileged daemon user (x2gobroker) has access to the PID file directory. - Set log level to CRITICAL if running unit tests. + - Perform PAM authentication via an authentication service (the broker + runs as non-privileged user, the authentication service as root). * /debian/control: + Add bin:package x2gobroker-agent. * /debian/x2gobroker-daemon.init: diff --git a/debian/x2gobroker-daemon.default b/debian/x2gobroker-daemon.default index ff315d5..f3c5bc0 100644 --- a/debian/x2gobroker-daemon.default +++ b/debian/x2gobroker-daemon.default @@ -1,35 +1,47 @@ # X2Go Session Broker configuration for Debian # Uncomment to enable the X2Go Session Broker standalone daemon -START_DAEMON=true +START_BROKER=true -# the posix user ID the broker runs under (do not change!) +# For PAM authentication the X2Go Session Broker needs its authentication +# service. The session broker itself runs as a non-privileged user (see below) +# whereas the authentication service must run as super-user root. +# +# If you do not use PAM as authentication mechanism with the X2Go Session Broker, +# you can disable the authentication service here. +START_AUTHSERVICE=true + +# The posix user ID the broker runs under (do not change!) # if you change it nonetheless, make sure that the log file # directory (default: /var/log/x2gobroker) and files in there are # writable by that user #X2GOBROKER_DAEMON_USER=x2gobroker -# run X2Go Session Broker in debug mode, this will make the broker +# Run X2Go Session Broker in debug mode, this will make the broker # available through http GET method calls (otherwise: POST method # only) and you will be able to test the broker through your web # browser (0=disable, 1=enable). #X2GOBROKER_DEBUG=0 -# bind standalone daemon to this address:port +# Bind standalone daemon to this address:port #DAEMON_BIND_ADDRESS=127.0.0.1:8080 -# default X2Go Session Broker backend (available: zeroconf, inifile) +# Default X2Go Session Broker backend (available: zeroconf, inifile) #X2GOBROKER_DEFAULT_BACKEND=zeroconf -# path to the X2Go Session Broker's configuration file +# Path to the X2Go Session Broker's configuration file #X2GOBROKER_CONFIG=/etc/x2go/x2gobroker.conf -# path to the X2Go Session Broker's session profiles file (when using the inifile backend) +# Path to the X2Go Session Broker's session profiles file (when using the inifile backend) #X2GOBROKER_SESSIONPROFILES=/etc/x2go/broker/x2gobroker-sessionprofiles.conf -# path to the X2Go Session Broker's agent command +# Path to the X2Go Session Broker's agent command #X2GOBROKER_AGENT_CMD=/usr/lib/x2go/x2gobroker-agent +# The unix socket file for communication between the broker and the authentication service. +#X2GOBROKER_AUTHSERVICE_SOCKET=/run/x2gobroker/x2gobroker-authservice.socket + + ########################################################## ### ### ### Enable SSL Support ### diff --git a/debian/x2gobroker-daemon.init b/debian/x2gobroker-daemon.init index fba7672..67276e4 100755 --- a/debian/x2gobroker-daemon.init +++ b/debian/x2gobroker-daemon.init @@ -19,13 +19,16 @@ set -eu DAEMON=/usr/sbin/x2gobroker +AUTHSERVICE=/usr/sbin/x2gobroker-authservice test -d /run && RUNDIR=/run || RUNDIR=/var/run -PIDFILE=$RUNDIR/x2gobroker/x2gobroker-daemon.pid +PIDFILE_BROKER=$RUNDIR/x2gobroker/x2gobroker-daemon.pid +PIDFILE_AUTHSERVICE=$RUNDIR/x2gobroker/x2gobroker-authservice.pid DEBIANCONFIG=/etc/default/x2gobroker-daemon test -x "$DAEMON" || exit 0 -START_DAEMON=false +START_BROKER=false +START_AUTHSERVICE=false DAEMON_BIND_ADDRESS=127.0.0.1:8080 X2GOBROKER_DEBUG=0 X2GOBROKER_DAEMON_USER='x2gobroker' @@ -33,6 +36,7 @@ X2GOBROKER_DEFAULT_BACKEND="zeroconf" X2GOBROKER_CONFIG="/etc/x2go/x2gobroker.conf" X2GOBROKER_SESSIONPROFILES="/etc/x2go/broker/x2gobroker-sessionprofiles.conf" X2GOBROKER_AGENT_CMD="/usr/lib/x2go/x2gobroker-agent" +X2GOBROKER_AUTHSERVICE_SOCKET="$RUNDIR/x2gobroker/x2gobroker-authservice.socket" X2GOBROKER_SSL_CERTFILE= X2GOBROKER_SSL_KEYFILE= test -f $DEBIANCONFIG && . $DEBIANCONFIG @@ -57,6 +61,7 @@ export X2GOBROKER_CONFIG export X2GOBROKER_DEFAULT_BACKEND export X2GOBROKER_SESSIONPROFILES export X2GOBROKER_AGENT_CMD +export X2GOBROKER_AUTHSERVICE_SOCKET export X2GOBROKER_SSL_CERTFILE export X2GOBROKER_SSL_KEYFILE @@ -72,28 +77,50 @@ is_true() case "${1:-}" in start) - if [ -e $PIDFILE ]; then + if [ -e $PIDFILE_BROKER ]; then if ps -u $X2GOBROKER_DAEMON_USER | grep $(basename $DAEMON) 1>/dev/null 2>/dev/null; then log_warning_msg "X2Go Session Broker already running" else - log_warning_msg "X2Go Session Broker: stale PID file ($PIDFILE). Delete it manually!" + log_warning_msg "X2Go Session Broker: stale PID file ($PIDFILE_BROKER). Delete it manually!" fi - START_DAEMON=no + START_BROKER=no fi - if is_true $START_DAEMON; then - log_daemon_msg "Starting X2Go Session Broker standalone daemon" $(basename $DAEMON) + if is_true $START_BROKER; then + log_daemon_msg "Starting X2Go Session Broker standalone daemon" "$(basename $DAEMON)" set +e - start-stop-daemon --chuid $X2GOBROKER_DAEMON_USER -b -m -S -p $PIDFILE -x $DAEMON -- -b $DAEMON_BIND_ADDRESS + start-stop-daemon --chuid $X2GOBROKER_DAEMON_USER -b -m -S -p $PIDFILE_BROKER -x $DAEMON -- -b $DAEMON_BIND_ADDRESS log_end_msg $? set -e + if [ -e $PIDFILE_AUTHSERVICE ]; then + if ps -u root | grep $(basename $AUTHSERVICE) 1>/dev/null 2>/dev/null; then + log_warning_msg "X2Go Broker Authentication Service already running" + else + log_warning_msg "X2Go Broker Authentication Service: stale PID file ($PIDFILE_AUTHSERVICE). Delete it manually!" + fi + START_AUTHSERVICE=no + fi + if is_true $START_AUTHSERVICE; then + set +e + log_daemon_msg "Starting X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" + start-stop-daemon -b -m -S -p $PIDFILE_AUTHSERVICE -x $AUTHSERVICE -- -s $X2GOBROKER_AUTHSERVICE_SOCKET + set -e + fi fi ;; stop) - if [ -f $PIDFILE ] ; then - log_daemon_msg "Stopping X2Go Session Broker standalone daemon" "x2gobroker" + if [ -f $PIDFILE_BROKER ] ; then + log_daemon_msg "Stopping X2Go Session Broker standalone daemon" "$(basename $DAEMON)" + set +e + start-stop-daemon -K -p $PIDFILE_BROKER + rm -f $PIDFILE_BROKER + log_end_msg $? + set -e + fi + if [ -f $PIDFILE_AUTHSERVICE ] ; then + log_daemon_msg "X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" set +e - start-stop-daemon -K -p $PIDFILE - rm -f $PIDFILE + start-stop-daemon -K -p $PIDFILE_AUTHSERVICE + rm -f $PIDFILE_AUTHSERVICE log_end_msg $? set -e fi diff --git a/debian/x2gobroker.install b/debian/x2gobroker.install index fac20e4..29dc1c0 100644 --- a/debian/x2gobroker.install +++ b/debian/x2gobroker.install @@ -1 +1,2 @@ sbin/x2gobroker usr/sbin/ +sbin/x2gobroker-authservice usr/sbin/ \ No newline at end of file diff --git a/sbin/x2gobroker b/sbin/x2gobroker index da91b0e..bb52019 100755 --- a/sbin/x2gobroker +++ b/sbin/x2gobroker @@ -1,5 +1,7 @@ #!/usr/bin/env python +# -*- coding: utf-8 -*- + # This file is part of the X2Go Project - http://www.x2go.org # Copyright (C) 2011-2012 by Oleksandr Shneyder <oleksandr.shneyder(a)obviously-nice.de> # Copyright (C) 2011-2012 by Heinz-Markus Graesing <heinz-m.graesing(a)obviously-nice.de> diff --git a/sbin/x2gobroker-authservice b/sbin/x2gobroker-authservice new file mode 100755 index 0000000..12974f8 --- /dev/null +++ b/sbin/x2gobroker-authservice @@ -0,0 +1,67 @@ +#!/usr/bin/env python + +# -*- coding: utf-8 -*- + +# This file is part of the X2Go Project - http://www.x2go.org +# Copyright (C) 2011-2012 by Oleksandr Shneyder <oleksandr.shneyder(a)obviously-nice.de> +# Copyright (C) 2011-2012 by Heinz-Markus Graesing <heinz-m.graesing(a)obviously-nice.de> +# Copyright (C) 2012 by Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> +# +# X2Go Session Broker is free software; you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# X2Go Session Broker is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program; if not, write to the +# Free Software Foundation, Inc., +# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. + +import os +import sys +import setproctitle +import argparse + +try: + import x2gobroker.authservice +except ImportError: + sys.path.insert(0, os.path.join(os.getcwd(), '..')) + import x2gobroker.authservice + +PROG_NAME = os.path.basename(sys.argv[0]) +PROG_OPTIONS = sys.argv[1:] +setproctitle.setproctitle("%s %s" % (PROG_NAME, " ".join(PROG_OPTIONS))) + +if __name__ == '__main__': + + common_options = [ + {'args':['-s','--socket-file'], 'default': x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET, 'metavar': 'AUTHSOCKET', 'help': 'socket file for AuthService communication', }, + {'args':['-d','--debug'], 'default': False, 'action': 'store_true', 'help': 'enable debugging code', }, + ] + p = argparse.ArgumentParser(description='X2Go Session Broker (PAM Auth Service)',\ + formatter_class=argparse.RawDescriptionHelpFormatter, \ + add_help=True, argument_default=None) + p_common = p.add_argument_group('common parameters') + + for (p_group, opts) in ( (p_common, common_options), ): + for opt in opts: + args = opt['args'] + del opt['args'] + p_group.add_argument(*args, **opt) + + cmdline_args = p.parse_args() + + if cmdline_args.debug: + x2gobroker.defaults.X2GOBROKER_DEBUG = cmdline_args.debug + + socket_file = cmdline_args.socket_file + x2gobroker.authservice.AuthService(socket_file) + try: + x2gobroker.authservice.loop() + except KeyboardInterrupt: + pass diff --git a/x2gobroker/authmechs/pam_authmech.py b/x2gobroker/authmechs/pam_authmech.py index fca5ec0..b46d1a2 100644 --- a/x2gobroker/authmechs/pam_authmech.py +++ b/x2gobroker/authmechs/pam_authmech.py @@ -18,7 +18,7 @@ # Free Software Foundation, Inc., # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. -import pam +import x2gobroker.authservice class X2GoBrokerAuthMech(object): @@ -26,7 +26,7 @@ class X2GoBrokerAuthMech(object): # do a simple PAM authentication against the PAM service ,,x2gobroker'' if username and password: - if pam.authenticate(username, password, service="x2gobroker"): + if x2gobroker.authservice.authenticate(username, password, service="x2gobroker"): return True return False diff --git a/x2gobroker/authservice.py b/x2gobroker/authservice.py new file mode 100644 index 0000000..018be90 --- /dev/null +++ b/x2gobroker/authservice.py @@ -0,0 +1,84 @@ +# -*- coding: utf-8 -*- + +# This file is part of the X2Go Project - http://www.x2go.org +# Copyright (C) 2011-2012 by Oleksandr Shneyder <oleksandr.shneyder(a)obviously-nice.de> +# Copyright (C) 2011-2012 by Heinz-Markus Graesing <heinz-m.graesing(a)obviously-nice.de> +# Copyright (C) 2012 by Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> +# +# X2Go Session Broker is free software; you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# X2Go Session Broker is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program; if not, write to the +# Free Software Foundation, Inc., +# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. + +import asyncore +import pam +import socket + +import x2gobroker.defaults + +class AuthClient(asyncore.dispatcher_with_send): + + def __init__(self, sock): + asyncore.dispatcher_with_send.__init__(self, sock) + self._buf = '' + + def handle_read(self): + data = self._buf + self.recv(1024) + if not data: + self.close() + return + reqs, data = data.rsplit('\n', 1) + self._buf = data + for req in reqs.split('\n'): + try: + user, passwd, service = req.split() + except: + self.send('bad\n') + else: + if pam.authenticate(user, passwd, service): + self.send('ok\n') + else: + self.send('fail\n') + + def handle_close(self): + self.close() + + +class AuthService(asyncore.dispatcher_with_send): + + def __init__(self, socketfile): + asyncore.dispatcher_with_send.__init__(self) + self.create_socket(socket.AF_UNIX, socket.SOCK_STREAM) + self.set_reuse_addr() + self.bind(socketfile) + self.listen(1) + + def handle_accept(self): + conn, _ = self.accept() + AuthClient(conn) + + +def loop(): + asyncore.loop() + + +def authenticate(username, password, service="x2gobroker"): + s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) + s.connect(x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET) + + s.send('{username} {password} {service}\n'.format(username=username, password=password, service=service)) + result = s.recv(1024) + s.close() + if result.startswith('ok'): + return True + return False diff --git a/x2gobroker/brokers/base_broker.py b/x2gobroker/brokers/base_broker.py index 6bbb227..be8b4e8 100644 --- a/x2gobroker/brokers/base_broker.py +++ b/x2gobroker/brokers/base_broker.py @@ -61,9 +61,10 @@ class X2GoBroker(object): X2Go Client with an intermediate session broker. """ - if config_file is None: config_file = x2gobroker.defaults.X2GOBROKER_CONFIG + self.config_file = config_file + if self.config_file is None: self.config_file = x2gobroker.defaults.X2GOBROKER_CONFIG if config_defaults is None: config_defaults = x2gobroker.defaults.X2GOBROKER_CONFIG_DEFAULTS - self.config = x2gobroker.config.X2GoBrokerConfigFile(config_files=config_file, defaults=config_defaults) + self.config = x2gobroker.config.X2GoBrokerConfigFile(config_files=self.config_file, defaults=config_defaults) self._dynamic_authid_map = {} self._client_address = None @@ -617,6 +618,7 @@ class X2GoBroker(object): ### This is handled through the config file, normally /etc/x2go/x2gobroker.conf if not self.config.get_value('global', 'check-credentials'): + logger_broker.debug('base_broker.X2GoBroker.check_access(): access is granted without checking credentials, prevent this in {configfile}'.format(configfile=self.config_file)) return True ### IMPLEMENT YOUR AUTHENTICATION LOGIC IN THE self._do_authenticate(**kwargs) METHOD @@ -624,6 +626,7 @@ class X2GoBroker(object): access = False access = self._do_authenticate(username=username, password=password) + logger_broker.debug('base_broker.X2GoBroker.check_access(): result of authentication check is: {access}'.format(access=access)) ### HANDLING OF DYNAMIC AUTHENTICATION ID HASHES diff --git a/x2gobroker/defaults.py b/x2gobroker/defaults.py index 4e90837..c02ce43 100644 --- a/x2gobroker/defaults.py +++ b/x2gobroker/defaults.py @@ -84,6 +84,12 @@ else: X2GOBROKER_AGENT_CMD = "/usr/lib/x2go/x2gobroker-agent" logger_broker.info(' X2GOBROKER_AGENT_CMD: {value}'.format(value=X2GOBROKER_AGENT_CMD)) +if os.environ.has_key('X2GOBROKER_AUTHSERVICE_SOCKET'): + X2GOBROKER_AUTHSERVICE_SOCKET=os.environ['X2GOBROKER_AUTHSERVICE_SOCKET'] +else: + X2GOBROKER_AUTHSERVICE_SOCKET="/var/run/x2gobroker-authservice.socket" +logger_broker.info(' X2GOBROKER_AUTHSERVICE_SOCKET: {value}'.format(value=X2GOBROKER_AUTHSERVICE_SOCKET)) + if os.environ.has_key('X2GOBROKER_DEFAULT_BACKEND'): X2GOBROKER_DEFAULT_BACKEND = os.environ['X2GOBROKER_DEFAULT_BACKEND'] else: hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

x2go-commits