#!/usr/bin/python # -*- coding: utf-8 -*- # (c) 2017, Ansible by Red Hat, inc # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) from __future__ import absolute_import, division, print_function __metaclass__ = type ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ['preview'], 'supported_by': 'network'} DOCUMENTATION = """ --- module: iosxr_user version_added: "2.4" author: - "Trishna Guha (@trishnaguha)" - "Sebastiaan van Doesselaar (@sebasdoes)" - "Kedar Kekan (@kedarX)" short_description: Manage the aggregate of local users on Cisco IOS XR device description: - This module provides declarative management of the local usernames configured on network devices. It allows playbooks to manage either individual usernames or the aggregate of usernames in the current running config. It also supports purging usernames from the configuration that are not explicitly defined. extends_documentation_fragment: iosxr notes: - Tested against IOS XRv 6.1.2 options: aggregate: description: - The set of username objects to be configured on the remote Cisco IOS XR device. The list entries can either be the username or a hash of username and properties. This argument is mutually exclusive with the C(name) argument. aliases: ['users', 'collection'] name: description: - The username to be configured on the Cisco IOS XR device. This argument accepts a string value and is mutually exclusive with the C(aggregate) argument. Please note that this option is not same as C(provider username). configured_password: description: - The password to be configured on the Cisco IOS XR device. The password needs to be provided in clear text. Password is encrypted on the device when used with I(cli) and by Ansible when used with I(netconf) using the same MD5 hash technique with salt size of 3. Please note that this option is not same as C(provider password). update_password: description: - Since passwords are encrypted in the device running config, this argument will instruct the module when to change the password. When set to C(always), the password will always be updated in the device and when set to C(on_create) the password will be updated only if the username is created. default: always choices: ['on_create', 'always'] group: description: - Configures the group for the username in the device running configuration. The argument accepts a string value defining the group name. This argument does not check if the group has been configured on the device. aliases: ['role'] groups: version_added: "2.5" description: - Configures the groups for the username in the device running configuration. The argument accepts a list of group names. This argument does not check if the group has been configured on the device. It is similar to the aggregrate command for usernames, but lets you configure multiple groups for the user(s). purge: description: - Instructs the module to consider the resource definition absolute. It will remove any previously configured usernames on the device with the exception of the `admin` user and the current defined set of users. type: bool default: false state: description: - Configures the state of the username definition as it relates to the device operational configuration. When set to I(present), the username(s) should be configured in the device active configuration and when set to I(absent) the username(s) should not be in the device active configuration default: present choices: ['present', 'absent'] public_key: version_added: "2.5" description: - Configures the contents of the public keyfile to upload to the IOS-XR node. This enables users to login using the accompanying private key. IOS-XR only accepts base64 decoded files, so this will be decoded and uploaded to the node. Do note that this requires an OpenSSL public key file, PuTTy generated files will not work! Mutually exclusive with public_key_contents. If used with multiple users in aggregates, then the same key file is used for all users. public_key_contents: version_added: "2.5" description: - Configures the contents of the public keyfile to upload to the IOS-XR node. This enables users to login using the accompanying private key. IOS-XR only accepts base64 decoded files, so this will be decoded and uploaded to the node. Do note that this requires an OpenSSL public key file, PuTTy generated files will not work! Mutually exclusive with public_key.If used with multiple users in aggregates, then the same key file is used for all users. requirements: - base64 when using I(public_key_contents) or I(public_key) - paramiko when using I(public_key_contents) or I(public_key) """ EXAMPLES = """ - name: create a new user iosxr_user: name: ansible configured_password: mypassword state: present - name: remove all users except admin iosxr_user: purge: True - name: set multiple users to group sys-admin iosxr_user: aggregate: - name: netop - name: netend group: sysadmin state: present - name: set multiple users to multiple groups iosxr_user: aggregate: - name: netop - name: netend groups: - sysadmin - root-system state: present - name: Change Password for User netop iosxr_user: name: netop configured_password: "{{ new_password }}" update_password: always state: present - name: Add private key authentication for user netop iosxr_user: name: netop state: present public_key_contents: "{{ lookup('file', '/home/netop/.ssh/id_rsa.pub' }}" """ RETURN = """ commands: description: The list of configuration mode commands to send to the device returned: always type: list sample: - username ansible secret password group sysadmin - username admin secret admin xml: description: NetConf rpc xml sent to device with transport C(netconf) returned: always (empty list when no xml rpc to send) type: list version_added: 2.5 sample: - ' test7 sysadmin $1$ZsXC$zZ50wqhDC543ZWQkkAHLW0 ' """ import os from functools import partial from copy import deepcopy import collections from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.network.common.utils import remove_default_spec from ansible.module_utils.network.iosxr.iosxr import get_config, load_config, is_netconf, is_cliconf from ansible.module_utils.network.iosxr.iosxr import iosxr_argument_spec, build_xml, etree_findall try: from base64 import b64decode HAS_B64 = True except ImportError: HAS_B64 = False try: import paramiko HAS_PARAMIKO = True except ImportError: HAS_PARAMIKO = False class PublicKeyManager(object): def __init__(self, module, result): self._module = module self._result = result def convert_key_to_base64(self): """ IOS-XR only accepts base64 decoded files, this converts the public key to a temp file. """ if self._module.params['aggregate']: name = 'aggregate' else: name = self._module.params['name'] if self._module.params['public_key_contents']: key = self._module.params['public_key_contents'] elif self._module.params['public_key']: readfile = open(self._module.params['public_key'], 'r') key = readfile.read() splitfile = key.split()[1] base64key = b64decode(splitfile) base64file = open('/tmp/publickey_%s.b64' % (name), 'wb') base64file.write(base64key) base64file.close() return '/tmp/publickey_%s.b64' % (name) def copy_key_to_node(self, base64keyfile): """ Copy key to IOS-XR node. We use SFTP because older IOS-XR versions don't handle SCP very well. """ if (self._module.params['host'] is None or self._module.params['provider']['host'] is None): return False if (self._module.params['username'] is None or self._module.params['provider']['username'] is None): return False if self._module.params['aggregate']: name = 'aggregate' else: name = self._module.params['name'] src = base64keyfile dst = '/harddisk:/publickey_%s.b64' % (name) user = self._module.params['username'] or self._module.params['provider']['username'] node = self._module.params['host'] or self._module.params['provider']['host'] password = self._module.params['password'] or self._module.params['provider']['password'] ssh_keyfile = self._module.params['ssh_keyfile'] or self._module.params['provider']['ssh_keyfile'] ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) if not ssh_keyfile: ssh.connect(node, username=user, password=password) else: ssh.connect(node, username=user, allow_agent=True) sftp = ssh.open_sftp() sftp.put(src, dst) sftp.close() ssh.close() def addremovekey(self, command): """ Add or remove key based on command """ if (self._module.params['host'] is None or self._module.params['provider']['host'] is None): return False if (self._module.params['username'] is None or self._module.params['provider']['username'] is None): return False user = self._module.params['username'] or self._module.params['provider']['username'] node = self._module.params['host'] or self._module.params['provider']['host'] password = self._module.params['password'] or self._module.params['provider']['password'] ssh_keyfile = self._module.params['ssh_keyfile'] or self._module.params['provider']['ssh_keyfile'] ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) if not ssh_keyfile: ssh.connect(node, username=user, password=password) else: ssh.connect(node, username=user, allow_agent=True) ssh_stdin, ssh_stdout, ssh_stderr = ssh.exec_command('%s \r' % (command)) readmsg = ssh_stdout.read(100) # We need to read a bit to actually apply for some reason if ('already' in readmsg) or ('removed' in readmsg) or ('really' in readmsg): ssh_stdin.write('yes\r') ssh_stdout.read(1) # We need to read a bit to actually apply for some reason ssh.close() return readmsg def run(self): if self._module.params['state'] == 'present': if not self._module.check_mode: key = self.convert_key_to_base64() copykeys = self.copy_key_to_node(key) if copykeys is False: self._result['warnings'].append('Please set up your provider before running this playbook') if self._module.params['aggregate']: for user in self._module.params['aggregate']: cmdtodo = "admin crypto key import authentication rsa username %s harddisk:/publickey_aggregate.b64" % (user) addremove = self.addremovekey(cmdtodo) if addremove is False: self._result['warnings'].append('Please set up your provider before running this playbook') else: cmdtodo = "admin crypto key import authentication rsa username %s harddisk:/publickey_%s.b64" % \ (self._module.params['name'], self._module.params['name']) addremove = self.addremovekey(cmdtodo) if addremove is False: self._result['warnings'].append('Please set up your provider before running this playbook') elif self._module.params['state'] == 'absent': if not self._module.check_mode: if self._module.params['aggregate']: for user in self._module.params['aggregate']: cmdtodo = "admin crypto key zeroize authentication rsa username %s" % (user) addremove = self.addremovekey(cmdtodo) if addremove is False: self._result['warnings'].append('Please set up your provider before running this playbook') else: cmdtodo = "admin crypto key zeroize authentication rsa username %s" % (self._module.params['name']) addremove = self.addremovekey(cmdtodo) if addremove is False: self._result['warnings'].append('Please set up your provider before running this playbook') elif self._module.params['purge'] is True: if not self._module.check_mode: cmdtodo = "admin crypto key zeroize authentication rsa all" addremove = self.addremovekey(cmdtodo) if addremove is False: self._result['warnings'].append('Please set up your provider before running this playbook') return self._result def search_obj_in_list(name, lst): for o in lst: if o['name'] == name: return o return None class ConfigBase(object): def __init__(self, module, result, flag=None): self._module = module self._result = result self._want = list() self._have = list() def get_param_value(self, key, item): # if key doesn't exist in the item, get it from module.params if not item.get(key): value = self._module.params[key] # if key does exist, do a type check on it to validate it else: value_type = self._module.argument_spec[key].get('type', 'str') type_checker = self._module._CHECK_ARGUMENT_TYPES_DISPATCHER[value_type] type_checker(item[key]) value = item[key] # validate the param value (if validator func exists) validator = globals().get('validate_%s' % key) if all((value, validator)): validator(value, self._module) return value def map_params_to_obj(self): users = self._module.params['aggregate'] aggregate = list() if not users: if not self._module.params['name'] and self._module.params['purge']: pass elif not self._module.params['name']: self._module.fail_json(msg='username is required') else: aggregate = [{'name': self._module.params['name']}] else: for item in users: if not isinstance(item, dict): aggregate.append({'name': item}) elif 'name' not in item: self._module.fail_json(msg='name is required') else: aggregate.append(item) for item in aggregate: get_value = partial(self.get_param_value, item=item) item['configured_password'] = get_value('configured_password') item['group'] = get_value('group') item['groups'] = get_value('groups') item['state'] = get_value('state') self._want.append(item) class CliConfiguration(ConfigBase): def __init__(self, module, result): super(CliConfiguration, self).__init__(module, result) def map_config_to_obj(self): data = get_config(self._module, config_filter='username') users = data.strip().rstrip('!').split('!') for user in users: user_config = user.strip().splitlines() name = user_config[0].strip().split()[1] group = None if len(user_config) > 1: group_or_secret = user_config[1].strip().split() if group_or_secret[0] == 'group': group = group_or_secret[1] obj = { 'name': name, 'state': 'present', 'configured_password': None, 'group': group } self._have.append(obj) def map_obj_to_commands(self): commands = list() for w in self._want: name = w['name'] state = w['state'] obj_in_have = search_obj_in_list(name, self._have) if state == 'absent' and obj_in_have: commands.append('no username ' + name) elif state == 'present' and not obj_in_have: user_cmd = 'username ' + name commands.append(user_cmd) if w['configured_password']: commands.append(user_cmd + ' secret ' + w['configured_password']) if w['group']: commands.append(user_cmd + ' group ' + w['group']) elif w['groups']: for group in w['groups']: commands.append(user_cmd + ' group ' + group) elif state == 'present' and obj_in_have: user_cmd = 'username ' + name if self._module.params['update_password'] == 'always' and w['configured_password']: commands.append(user_cmd + ' secret ' + w['configured_password']) if w['group'] and w['group'] != obj_in_have['group']: commands.append(user_cmd + ' group ' + w['group']) elif w['groups']: for group in w['groups']: commands.append(user_cmd + ' group ' + group) if self._module.params['purge']: want_users = [x['name'] for x in self._want] have_users = [x['name'] for x in self._have] for item in set(have_users).difference(set(want_users)): if item != 'admin': commands.append('no username %s' % item) if 'no username admin' in commands: self._module.fail_json(msg='cannot delete the `admin` account') self._result['commands'] = [] if commands: commit = not self._module.check_mode diff = load_config(self._module, commands, commit=commit) if diff: self._result['diff'] = dict(prepared=diff) self._result['commands'] = commands self._result['changed'] = True def run(self): self.map_params_to_obj() self.map_config_to_obj() self.map_obj_to_commands() return self._result class NCConfiguration(ConfigBase): def __init__(self, module, result): super(NCConfiguration, self).__init__(module, result) self._locald_meta = collections.OrderedDict() self._locald_group_meta = collections.OrderedDict() def generate_md5_hash(self, arg): ''' Generate MD5 hash with randomly generated salt size of 3. :param arg: :return passwd: ''' cmd = "openssl passwd -salt `openssl rand -base64 3` -1 " return os.popen(cmd + arg).readlines()[0].strip() def map_obj_to_xml_rpc(self): self._locald_meta.update([ ('aaa_locald', {'xpath': 'aaa/usernames', 'tag': True, 'ns': True}), ('username', {'xpath': 'aaa/usernames/username', 'tag': True, 'attrib': "operation"}), ('a:name', {'xpath': 'aaa/usernames/username/name'}), ('a:configured_password', {'xpath': 'aaa/usernames/username/secret', 'operation': 'edit'}), ]) self._locald_group_meta.update([ ('aaa_locald', {'xpath': 'aaa/usernames', 'tag': True, 'ns': True}), ('username', {'xpath': 'aaa/usernames/username', 'tag': True, 'attrib': "operation"}), ('a:name', {'xpath': 'aaa/usernames/username/name'}), ('usergroups', {'xpath': 'aaa/usernames/username/usergroup-under-usernames', 'tag': True, 'operation': 'edit'}), ('usergroup', {'xpath': 'aaa/usernames/username/usergroup-under-usernames/usergroup-under-username', 'tag': True, 'operation': 'edit'}), ('a:group', {'xpath': 'aaa/usernames/username/usergroup-under-usernames/usergroup-under-username/name', 'operation': 'edit'}), ]) state = self._module.params['state'] _get_filter = build_xml('aaa', opcode="filter") running = get_config(self._module, source='running', config_filter=_get_filter) elements = etree_findall(running, 'username') users = list() for element in elements: name_list = etree_findall(element, 'name') users.append(name_list[0].text) list_size = len(name_list) if list_size == 1: self._have.append({'name': name_list[0].text, 'group': None, 'groups': None}) elif list_size == 2: self._have.append({'name': name_list[0].text, 'group': name_list[1].text, 'groups': None}) elif list_size > 2: name_iter = iter(name_list) next(name_iter) tmp_list = list() for name in name_iter: tmp_list.append(name.text) self._have.append({'name': name_list[0].text, 'group': None, 'groups': tmp_list}) locald_params = list() locald_group_params = list() opcode = None if state == 'absent': opcode = "delete" for want_item in self._want: if want_item['name'] in users: want_item['configured_password'] = None locald_params.append(want_item) elif state == 'present': opcode = "merge" for want_item in self._want: if want_item['name'] not in users: want_item['configured_password'] = self.generate_md5_hash(want_item['configured_password']) locald_params.append(want_item) if want_item['group'] is not None: locald_group_params.append(want_item) if want_item['groups'] is not None: for group in want_item['groups']: want_item['group'] = group locald_group_params.append(want_item.copy()) else: if self._module.params['update_password'] == 'always' and want_item['configured_password'] is not None: want_item['configured_password'] = self.generate_md5_hash(want_item['configured_password']) locald_params.append(want_item) else: want_item['configured_password'] = None obj_in_have = search_obj_in_list(want_item['name'], self._have) if want_item['group'] is not None and want_item['group'] != obj_in_have['group']: locald_group_params.append(want_item) elif want_item['groups'] is not None: for group in want_item['groups']: want_item['group'] = group locald_group_params.append(want_item.copy()) purge_params = list() if self._module.params['purge']: want_users = [x['name'] for x in self._want] have_users = [x['name'] for x in self._have] for item in set(have_users).difference(set(want_users)): if item != 'admin': purge_params.append({'name': item}) self._result['xml'] = [] _edit_filter_list = list() if opcode is not None: if locald_params: _edit_filter_list.append(build_xml('aaa', xmap=self._locald_meta, params=locald_params, opcode=opcode)) if locald_group_params: _edit_filter_list.append(build_xml('aaa', xmap=self._locald_group_meta, params=locald_group_params, opcode=opcode)) if purge_params: _edit_filter_list.append(build_xml('aaa', xmap=self._locald_meta, params=purge_params, opcode="delete")) diff = None if _edit_filter_list: commit = not self._module.check_mode diff = load_config(self._module, _edit_filter_list, commit=commit, running=running, nc_get_filter=_get_filter) if diff: if self._module._diff: self._result['diff'] = dict(prepared=diff) self._result['xml'] = _edit_filter_list self._result['changed'] = True def run(self): self.map_params_to_obj() self.map_obj_to_xml_rpc() return self._result def main(): """ main entry point for module execution """ element_spec = dict( name=dict(), configured_password=dict(no_log=True), update_password=dict(default='always', choices=['on_create', 'always']), public_key=dict(), public_key_contents=dict(), group=dict(aliases=['role']), groups=dict(type='list', elements='dict'), state=dict(default='present', choices=['present', 'absent']) ) aggregate_spec = deepcopy(element_spec) aggregate_spec['name'] = dict(required=True) # remove default in aggregate spec, to handle common arguments remove_default_spec(aggregate_spec) mutually_exclusive = [('name', 'aggregate'), ('public_key', 'public_key_contents'), ('group', 'groups')] argument_spec = dict( aggregate=dict(type='list', elements='dict', options=aggregate_spec, aliases=['users', 'collection'], mutually_exclusive=mutually_exclusive), purge=dict(type='bool', default=False) ) argument_spec.update(element_spec) argument_spec.update(iosxr_argument_spec) module = AnsibleModule(argument_spec=argument_spec, mutually_exclusive=mutually_exclusive, supports_check_mode=True) if (module.params['public_key_contents'] or module.params['public_key']): if not HAS_B64: module.fail_json( msg='library base64 is required but does not appear to be ' 'installed. It can be installed using `pip install base64`' ) if not HAS_PARAMIKO: module.fail_json( msg='library paramiko is required but does not appear to be ' 'installed. It can be installed using `pip install paramiko`' ) result = {'changed': False, 'warnings': []} if module.params['password'] and not module.params['configured_password']: result['warnings'].append( 'The "password" argument is used to authenticate the current connection. ' + 'To set a user password use "configured_password" instead.' ) config_object = None if is_cliconf(module): module.deprecate(msg="cli support for 'iosxr_user' is deprecated. Use transport netconf instead", version="4 releases from v2.5") config_object = CliConfiguration(module, result) elif is_netconf(module): config_object = NCConfiguration(module, result) if config_object: result = config_object.run() if module.params['public_key_contents'] or module.params['public_key']: pubkey_object = PublicKeyManager(module, result) result = pubkey_object.run() module.exit_json(**result) if __name__ == '__main__': main()