[X2go-Commits] x2gobroker.git - master (branch) updated: 0.0.0.1-36-gfbb1f87

The branch, master has been updated via fbb1f8755341c5f318b3e3ee2602487005612e4e (commit) from d9c17a236357d7939415afae5b420917f0e2f212 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fbb1f8755341c5f318b3e3ee2602487005612e4e Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de> Date: Wed Feb 20 01:17:32 2013 +0100 separate x2gobroker-daemon and x2gobroker-authservice into two separate packages ----------------------------------------------------------------------- Summary of changes: debian/control | 37 +++++++++++- debian/x2gobroker-authservice.default | 19 ++++++ debian/x2gobroker-authservice.init | 102 ++++++++++++++++++++++++++++++++ debian/x2gobroker-authservice.install | 1 + debian/x2gobroker-authservice.manpages | 1 + debian/x2gobroker-daemon.init | 36 ++--------- debian/x2gobroker.install | 1 - etc/broker/x2gobroker-loggers.conf | 23 ++++++- sbin/x2gobroker-authservice | 14 ++--- x2gobroker/authservice.py | 23 +++++-- x2gobroker/defaults.py | 1 + x2gobroker/loggers.py | 5 ++ 12 files changed, 215 insertions(+), 48 deletions(-) create mode 100644 debian/x2gobroker-authservice.default create mode 100755 debian/x2gobroker-authservice.init create mode 100644 debian/x2gobroker-authservice.install create mode 100644 debian/x2gobroker-authservice.manpages The diff of changes is: diff --git a/debian/control b/debian/control index 3b222bc..4a7be0d 100644 --- a/debian/control +++ b/debian/control @@ -20,8 +20,9 @@ Depends: ${misc:Depends}, ${python:Depends}, python, - python-x2gobroker (>= ${source:Version}), python-x2gobroker (<< ${source:Version}.1~), + python-argparse, python-setproctitle, + python-x2gobroker (>= ${source:Version}), python-x2gobroker (<< ${source:Version}.1~), Suggests: apache2 | httpd, Description: X2Go http(s) based session broker (executable) @@ -45,12 +46,46 @@ Description: X2Go http(s) based session broker (executable) . This package contains the x2gobroker executable. +Package: x2gobroker-authservice +Architecture: all +Depends: + python, + python-argparse, + python-setproctitle, + ${misc:Depends}, + ${python:Depends}, +Suggests: + apache2 | httpd, +Description: X2Go http(s) based session broker (PAM authentication service) + X2Go is a server based computing environment with + - session resuming + - low bandwidth support + - LDAP support + - client side mass storage mounting support + - client side printing support + - audio support + - authentication by smartcard and USB stick + . + The session broker is a server tool for X2Go that + tells your X2Go Client application in a terminal + server cluster what servers and session types are + most appropriate for the user in front of the + X2Go terminal. + . + A session broker is most useful in load balanced + X2Go server farms. + . + This package contains the authentication service + against the PAM system. + Package: x2gobroker-daemon Architecture: all Depends: ${misc:Depends}, ${python:Depends}, x2gobroker (>= ${source:Version}), x2gobroker (<< ${source:Version}.1~), +Recommends: + x2gobroker-authservice, Suggests: apache2 | httpd, Description: X2Go http(s) based session broker (daemon) diff --git a/debian/x2gobroker-authservice.default b/debian/x2gobroker-authservice.default new file mode 100644 index 0000000..9f89cd4 --- /dev/null +++ b/debian/x2gobroker-authservice.default @@ -0,0 +1,19 @@ +# X2Go Session Broker (PAM Authentication Service) configuration for Debian + +# For PAM authentication the X2Go Session Broker needs its authentication +# service. The session broker itself runs as a non-privileged user (see below) +# whereas the authentication service must run as super-user root. +# +# If you do not use PAM as authentication mechanism with the X2Go Session Broker, +# you can disable the authentication service here. +START_AUTHSERVICE=true + +# The posix user ID the broker runs under (do not change!) +# if you change it nonetheless, make sure that the log file +# directory (default: /var/log/x2gobroker) and files in there are +# writable by that user +#X2GOBROKER_DAEMON_GROUP=x2gobroker + +# The unix socket file for communication between the broker and the authentication service. +#X2GOBROKER_AUTHSERVICE_SOCKET=/run/x2gobroker/x2gobroker-authservice.socket + diff --git a/debian/x2gobroker-authservice.init b/debian/x2gobroker-authservice.init new file mode 100755 index 0000000..ccbad0a --- /dev/null +++ b/debian/x2gobroker-authservice.init @@ -0,0 +1,102 @@ +#!/bin/sh +# +# Start the X2Go Session Broker PAM Authentication Service +# +# Copyright © 2012 Mike Gabriel <mike.gabriel@das-netzwerkteam.de> +# Distributable under the terms of the GNU AGPL version 2. +# +### BEGIN INIT INFO +# Provides: x2gobroker-authservice +# Required-Start: $remote_fs $syslog +# Required-Stop: $remote_fs $syslog +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: X2Go Session Broker PAM Authentication Service +# Description: PAM authentication service for X2Go Session Broker +### END INIT INFO +# + +set -eu + +AUTHSERVICE=/usr/sbin/x2gobroker-authservice +test -d /run && RUNDIR=/run || RUNDIR=/var/run +PIDFILE_AUTHSERVICE=$RUNDIR/x2gobroker/x2gobroker-authservice.pid +DEBIANCONFIG=/etc/default/x2gobroker-authservice + +test -x "$AUTHSERVICE" || exit 0 + +START_AUTHSERVICE=false +X2GOBROKER_DAEMON_USER='x2gobroker' +X2GOBROKER_DAEMON_GROUP='x2gobroker' +X2GOBROKER_AUTHSERVICE_SOCKET="$RUNDIR/x2gobroker/x2gobroker-authservice.socket" +test -f $DEBIANCONFIG && . $DEBIANCONFIG + + +if ! getent passwd $X2GOBROKER_DAEMON_USER 1>/dev/null 2>/dev/null; then + X2GOBROKER_DAEMON_USER=nobody +fi +if ! getent group $X2GOBROKER_DAEMON_GROUP 1>/dev/null 2>/dev/null; then + X2GOBROKER_DAEMON_USER=nogroup +fi + +# create PID directory +mkdir -p $RUNDIR/x2gobroker +chown $X2GOBROKER_DAEMON_USER:$X2GOBROKER_DAEMON_GROUP $RUNDIR/x2gobroker +chmod 0700 $RUNDIR/x2gobroker + +export X2GOBROKER_DAEMON_USER +export X2GOBROKER_DAEMON_GROUP +export X2GOBROKER_AUTHSERVICE_SOCKET + +. /lib/lsb/init-functions + +is_true() +{ + case "${1:-}" in + [Yy]es|[Yy]|1|[Tt]|[Tt]rue) return 0;; + *) return 1; + esac +} + +case "${1:-}" in + start) + if [ -f $PIDFILE_AUTHSERVICE ]; then + if ps -u root | grep $(basename $AUTHSERVICE) 1>/dev/null 2>/dev/null; then + log_warning_msg "X2Go Broker Authentication Service already running" + else + log_warning_msg "X2Go Broker Authentication Service: stale PID file ($PIDFILE_AUTHSERVICE). Delete it manually!" + fi + START_AUTHSERVICE=no + fi + if is_true $START_AUTHSERVICE; then + set +e + # once we are here, we have to make sure the authservice.socket does not exist + rm -f $X2GOBROKER_AUTHSERVICE_SOCKET + # and now we can start the auth service + log_daemon_msg "Starting X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" + start-stop-daemon -b -m -S -p $PIDFILE_AUTHSERVICE -x $AUTHSERVICE -- -s $X2GOBROKER_AUTHSERVICE_SOCKET -o root -g $X2GOBROKER_DAEMON_GROUP -p 0660 + set -e + log_end_msg $? + fi + ;; + stop) + if [ -f $PIDFILE_AUTHSERVICE ] ; then + log_daemon_msg "X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" + set +e + start-stop-daemon -K -p $PIDFILE_AUTHSERVICE + rm -f $PIDFILE_AUTHSERVICE + log_end_msg $? + set -e + fi + ;; + restart|reload|force-reload) + ${0:-} stop + ${0:-} start + ;; + *) + echo "Usage: ${0:-} {start|stop|restart|reload|force-reload}" >&2 + exit 1 + ;; +esac + +exit 0 diff --git a/debian/x2gobroker-authservice.install b/debian/x2gobroker-authservice.install new file mode 100644 index 0000000..03fb37c --- /dev/null +++ b/debian/x2gobroker-authservice.install @@ -0,0 +1 @@ +sbin/x2gobroker-authservice usr/sbin/ \ No newline at end of file diff --git a/debian/x2gobroker-authservice.manpages b/debian/x2gobroker-authservice.manpages new file mode 100644 index 0000000..f32e545 --- /dev/null +++ b/debian/x2gobroker-authservice.manpages @@ -0,0 +1 @@ +#man/man8/x2gobroker-authservice.8 \ No newline at end of file diff --git a/debian/x2gobroker-daemon.init b/debian/x2gobroker-daemon.init index 67276e4..a632a86 100755 --- a/debian/x2gobroker-daemon.init +++ b/debian/x2gobroker-daemon.init @@ -7,7 +7,7 @@ # ### BEGIN INIT INFO # Provides: x2gobroker-daemon -# Required-Start: $remote_fs $syslog +# Required-Start: $remote_fs $syslog x2gobroker-authservice # Required-Stop: $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 @@ -19,16 +19,14 @@ set -eu DAEMON=/usr/sbin/x2gobroker -AUTHSERVICE=/usr/sbin/x2gobroker-authservice test -d /run && RUNDIR=/run || RUNDIR=/var/run PIDFILE_BROKER=$RUNDIR/x2gobroker/x2gobroker-daemon.pid -PIDFILE_AUTHSERVICE=$RUNDIR/x2gobroker/x2gobroker-authservice.pid DEBIANCONFIG=/etc/default/x2gobroker-daemon +DEBIANCONFIG_AUTHSERVICE=/etc/default/x2gobroker-daemon test -x "$DAEMON" || exit 0 START_BROKER=false -START_AUTHSERVICE=false DAEMON_BIND_ADDRESS=127.0.0.1:8080 X2GOBROKER_DEBUG=0 X2GOBROKER_DAEMON_USER='x2gobroker' @@ -40,16 +38,12 @@ X2GOBROKER_AUTHSERVICE_SOCKET="$RUNDIR/x2gobroker/x2gobroker-authservice.socket" X2GOBROKER_SSL_CERTFILE= X2GOBROKER_SSL_KEYFILE= test -f $DEBIANCONFIG && . $DEBIANCONFIG +test -f $DEBIANCONFIG_AUTHSERVICE && . $DEBIANCONFIG_AUTHSERVICE if ! getent passwd $X2GOBROKER_DAEMON_USER 1>/dev/null 2>/dev/null; then X2GOBROKER_DAEMON_USER=nobody fi -# create PID directory -mkdir -p $RUNDIR/x2gobroker -chown $X2GOBROKER_DAEMON_USER:nogroup $RUNDIR/x2gobroker -chmod 0700 $RUNDIR/x2gobroker - # mend user ID variables when --chuid $X2GOBROKER_DAEMON_USER is used with start-stop-daemon export LOGNAME=$X2GOBROKER_DAEMON_USER export USER=$X2GOBROKER_DAEMON_USER @@ -77,7 +71,7 @@ is_true() case "${1:-}" in start) - if [ -e $PIDFILE_BROKER ]; then + if [ -f $PIDFILE_BROKER ]; then if ps -u $X2GOBROKER_DAEMON_USER | grep $(basename $DAEMON) 1>/dev/null 2>/dev/null; then log_warning_msg "X2Go Session Broker already running" else @@ -91,20 +85,6 @@ case "${1:-}" in start-stop-daemon --chuid $X2GOBROKER_DAEMON_USER -b -m -S -p $PIDFILE_BROKER -x $DAEMON -- -b $DAEMON_BIND_ADDRESS log_end_msg $? set -e - if [ -e $PIDFILE_AUTHSERVICE ]; then - if ps -u root | grep $(basename $AUTHSERVICE) 1>/dev/null 2>/dev/null; then - log_warning_msg "X2Go Broker Authentication Service already running" - else - log_warning_msg "X2Go Broker Authentication Service: stale PID file ($PIDFILE_AUTHSERVICE). Delete it manually!" - fi - START_AUTHSERVICE=no - fi - if is_true $START_AUTHSERVICE; then - set +e - log_daemon_msg "Starting X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" - start-stop-daemon -b -m -S -p $PIDFILE_AUTHSERVICE -x $AUTHSERVICE -- -s $X2GOBROKER_AUTHSERVICE_SOCKET - set -e - fi fi ;; stop) @@ -116,14 +96,6 @@ case "${1:-}" in log_end_msg $? set -e fi - if [ -f $PIDFILE_AUTHSERVICE ] ; then - log_daemon_msg "X2Go Broker Authentication Service" "$(basename $AUTHSERVICE)" - set +e - start-stop-daemon -K -p $PIDFILE_AUTHSERVICE - rm -f $PIDFILE_AUTHSERVICE - log_end_msg $? - set -e - fi ;; restart|reload|force-reload) ${0:-} stop diff --git a/debian/x2gobroker.install b/debian/x2gobroker.install index 29dc1c0..fac20e4 100644 --- a/debian/x2gobroker.install +++ b/debian/x2gobroker.install @@ -1,2 +1 @@ sbin/x2gobroker usr/sbin/ -sbin/x2gobroker-authservice usr/sbin/ \ No newline at end of file diff --git a/etc/broker/x2gobroker-loggers.conf b/etc/broker/x2gobroker-loggers.conf index 36d5e3e..4c395a2 100644 --- a/etc/broker/x2gobroker-loggers.conf +++ b/etc/broker/x2gobroker-loggers.conf @@ -18,18 +18,20 @@ # Free Software Foundation, Inc., # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. +# WARNING: only modify this file if you _exactly_ know what you are doing!!! + [loggers] -keys=root,broker,access,error +keys=root,broker,authservice,access,error [logger_root] level=NOTSET handlers=stdoutHandler [handlers] -keys=stdoutHandler,brokerFileHandler,accessFileHandler,errorFileHandler +keys=stdoutHandler,brokerFileHandler,authserviceFileHandler,accessFileHandler,errorFileHandler [formatters] -keys=brokerFormatter,accessFormatter,errorFormatter +keys=brokerFormatter,authserviceFormatter,accessFormatter,errorFormatter [handler_stdoutHandler] class=StreamHandler @@ -50,6 +52,21 @@ args=('/var/log/x2gobroker/broker.log',) format=%(asctime)s - %(name)s - %(levelname)s - %(message)s datefmt= +[logger_authservice] +level=DEBUG +handlers=authserviceFileHandler +qualname=authservice +propagate=0 + +[handler_authserviceFileHandler] +class=FileHandler +formatter=authserviceFormatter +args=('/var/log/x2gobroker/authservice.log',) + +[formatter_authserviceFormatter] +format=%(asctime)s - %(name)s - %(levelname)s - %(message)s +datefmt= + [logger_access] level=DEBUG handlers=accessFileHandler diff --git a/sbin/x2gobroker-authservice b/sbin/x2gobroker-authservice index 12974f8..6ff6423 100755 --- a/sbin/x2gobroker-authservice +++ b/sbin/x2gobroker-authservice @@ -40,10 +40,13 @@ setproctitle.setproctitle("%s %s" % (PROG_NAME, " ".join(PROG_OPTIONS))) if __name__ == '__main__': common_options = [ - {'args':['-s','--socket-file'], 'default': x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET, 'metavar': 'AUTHSOCKET', 'help': 'socket file for AuthService communication', }, - {'args':['-d','--debug'], 'default': False, 'action': 'store_true', 'help': 'enable debugging code', }, + {'args':['-s','--socket-file'], 'default': x2gobroker.authservice.X2GOBROKER_AUTHSERVICE_SOCKET, 'metavar': 'AUTHSOCKET', 'help': 'socket file for AuthService communication', }, + {'args':['-o','--owner'], 'default': 'root', 'help': 'owner of the AuthService socket file', }, + {'args':['-g','--group'], 'default': 'root', 'help': 'group ownership of the AuthService socket file', }, + {'args':['-p','--permissions'], 'default': '0660', 'help': 'set these file permissions for the AuthService socket file', }, + ] - p = argparse.ArgumentParser(description='X2Go Session Broker (PAM Auth Service)',\ + p = argparse.ArgumentParser(description='X2Go Session Broker (PAM Authentication Service)',\ formatter_class=argparse.RawDescriptionHelpFormatter, \ add_help=True, argument_default=None) p_common = p.add_argument_group('common parameters') @@ -56,11 +59,8 @@ if __name__ == '__main__': cmdline_args = p.parse_args() - if cmdline_args.debug: - x2gobroker.defaults.X2GOBROKER_DEBUG = cmdline_args.debug - socket_file = cmdline_args.socket_file - x2gobroker.authservice.AuthService(socket_file) + x2gobroker.authservice.AuthService(socket_file, owner=cmdline_args.owner, group_owner=cmdline_args.group, permissions=cmdline_args.permissions) try: x2gobroker.authservice.loop() except KeyboardInterrupt: diff --git a/x2gobroker/authservice.py b/x2gobroker/authservice.py index 018be90..7b12bb9 100644 --- a/x2gobroker/authservice.py +++ b/x2gobroker/authservice.py @@ -20,11 +20,23 @@ # Free Software Foundation, Inc., # 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. +import os import asyncore import pam import socket -import x2gobroker.defaults +from pwd import getpwnam +from grp import getgrnam + +from loggers import logger_authservice + +logger_authservice.info('X2Go Session Broker PAM Authentication Service: Setting up the broker\'s environment...') +if os.environ.has_key('X2GOBROKER_AUTHSERVICE_SOCKET'): + X2GOBROKER_AUTHSERVICE_SOCKET=os.environ['X2GOBROKER_AUTHSERVICE_SOCKET'] +else: + X2GOBROKER_AUTHSERVICE_SOCKET="/var/run/x2gobroker-authservice.socket" +logger_authservice.info(' X2GOBROKER_AUTHSERVICE_SOCKET: {value}'.format(value=X2GOBROKER_AUTHSERVICE_SOCKET)) + class AuthClient(asyncore.dispatcher_with_send): @@ -56,11 +68,13 @@ class AuthClient(asyncore.dispatcher_with_send): class AuthService(asyncore.dispatcher_with_send): - def __init__(self, socketfile): + def __init__(self, socketfile, owner='root', group_owner='root', permissions='0660'): asyncore.dispatcher_with_send.__init__(self) self.create_socket(socket.AF_UNIX, socket.SOCK_STREAM) self.set_reuse_addr() self.bind(socketfile) + os.chown(socketfile, getpwnam(owner).pw_uid, getgrnam(group_owner).gr_gid) + os.chmod(socketfile, int(permissions, 8)) self.listen(1) def handle_accept(self): @@ -74,11 +88,12 @@ def loop(): def authenticate(username, password, service="x2gobroker"): s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) - s.connect(x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET) - + s.connect(X2GOBROKER_AUTHSERVICE_SOCKET) s.send('{username} {password} {service}\n'.format(username=username, password=password, service=service)) result = s.recv(1024) s.close() if result.startswith('ok'): + logger_authservice.info('authentication against PAM service {service} succeeded for {username}'.format(username=username, service=service)) return True + logger_authservice.info('authentication against service {service} failed for user {username}'.format(username=username, service=service)) return False diff --git a/x2gobroker/defaults.py b/x2gobroker/defaults.py index c02ce43..f56a566 100644 --- a/x2gobroker/defaults.py +++ b/x2gobroker/defaults.py @@ -68,6 +68,7 @@ elif os.geteuid() == 0: logger_broker.warn('X2Go Session Broker should not be run as root, better run as non-privileged user') logger_broker.info('Setting up the broker\'s environment...') +logger_broker.info('X2Go Session Broker: Setting up the broker\'s environment...') logger_broker.info(' X2GOBROKER_DEBUG: {value}'.format(value=X2GOBROKER_DEBUG)) if os.environ.has_key('X2GOBROKER_CONFIG'): diff --git a/x2gobroker/loggers.py b/x2gobroker/loggers.py index 7791bbd..2dd9178 100644 --- a/x2gobroker/loggers.py +++ b/x2gobroker/loggers.py @@ -43,6 +43,7 @@ if getpass.getuser() == X2GOBROKER_DAEMON_USER: # create loggers logger_broker = logging.getLogger('broker') + logger_authservice = logging.getLogger('authservice') logger_access = logging.getLogger('access') logger_error = logging.getLogger('error') @@ -58,6 +59,10 @@ else: logger_broker.addHandler(stdout_handler) logger_broker.propagate = 0 + logger_authservice = logging.getLogger('authservice') + logger_authservice.addHandler(stdout_handler) + logger_authservice.propagate = 0 + logger_access = logging.getLogger('access') logger_access.addHandler(stdout_handler) logger_access.propagate = 0 hooks/post-receive -- x2gobroker.git (HTTP(S) Session broker for X2Go) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "x2gobroker.git" (HTTP(S) Session broker for X2Go).