7}OdF d Z ddlZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z ddl m
Z
mZ ddlmZmZ ej e Z G d d
e
ZdS ) zgPAM module management plugin.
Changes PAM module state (enabled/disabled) to match imunify360 config.
N)config) SystemConfig) MessageType) MessageSinkexpect)recurring_checksafe_cancel_task)ossecpamc n e Zd ZdZ ej dd Z ej dd Z ej dd Z ej dd Z d Z
dd
Z dd Z dd Z
d
ej dedefdZd Z ed d Z ee d Z eej dej fd Zd S )
PAMManageri PAMenableexim_dovecot_protectionexim_dovecot_nativeftp_protectionc R g | _ t j | _ d | _ d S N)_tasksasyncioEvent_status_check_required_loopselfs N/opt/imunify360/venv/lib/python3.11/site-packages/im360/plugins/pam_manager.py__init__zPAMManager.__init__ s" &-moo#
returnNc K || _ | j | | | j | | d S r )r r append create_task_status_checker_initiate_status_check)r loops r create_sinkzPAMManager.create_sink ss
4++D,@,@,B,BCCDDD 4++D,G,G,I,IJJKKKKKr c L K | j D ]}|t | d {V d S r )r r )r tasks r shutdownzPAMManager.shutdown% sH K - -D &t,,,,,,,,, - -r c K t j d {V }| | j st j j n(| j st j j nt j j | d {V | | j
|t j j d {V | | j
|t j j d {V t t j d {V }|t j j |t j j cxk rt j j k rn nt j j nt j j |t* j < |t j j = |t j j = t+ j | d {V d S # t* j $ r&}t2 d| Y d }~d S d }~ww xY w)N)desired_dovecot_status
pam_statusz(Failed to update OSSEC configuration: %s)r
get_status_ensure_status_for_dovecot_DOVECOT_PROTECTION_ENABLED
DovecotStatusDISABLED_DOVECOT_NATIVE_ENABLEDr NATIVE_ensure_status_for_service _FTP_ENABLED
PamServiceFTP
_SSHD_ENABLEDSSHDdictDOVECOT_NATIVE DOVECOT_PAMPamServiceStatusValuedisabledenabledr
DOVECOTconfigure_for_pamOssecRulesErrorloggererror)r statusexcs r _ensure_statuszPAMManager._ensure_status* s` ~''''''''--3$*3#4#=#= /*"&&")
.
-- vs~'9
-- (;
CN , ,,,,,,,-- cn34cn012 2 2 2(12 2 2 2 2
% . . *2 u}
3>0 1 3>- . J)&11 1 1 1 1 1 1 1 1 1$ J J J LLCS I I I I I I I I I Js F9 9G.G))G.r+ r, c K |t j j u r|t j j |t j j cxk rt j j k sEn t j t j j d{V t
d n|t j j u r|t j j t j j k rG|t j j t j j k rt
d| n t j j }t j | d{V t
d| dS |t j j u r|t j j t j j k rF|t j j t j j k rt
d| nRt j j }t j | d{V t
d| dS J d dS ) zEnsure pam status corresponds to the desired dovecot status.
Special handling for 3 states.
Return whether pam/native modules were enabled.
Nz(PAM module has been disabled for dovecotz=Unexpected PAM state: both pam/native are enabled. Status: %s"PAM module has been enabled for %sTr z can't happenF)r r0 r1 r6 r; r< r= r> disablerC infor r? rD r r3 )r r+ r, pam_services r r. z%PAMManager._ensure_status_for_dovecotN s+ "S%6%? ? ?3>89 cn 896 6 6 6,56 6 6 6 k#."?@@@@@@@@@ FGGG
#s'8'<
<
<3>56,45 5 s~ <=089 9 LL&" "n 8 j--------- @+NNNt
#s'8'?
?
?3>89,45 5 s~ 9:089 9 LL&" "n ; j--------- @+NNNt $n $ $1ur c F K |rt j j nt j j }||| k rn|r7t j | d {V t
d| dS t j | d {V t
d| dS )NrI Tz#PAM module has been disabled for %sF)r r= r? r> r rC rK rJ )r should_be_enabledrE rL expected_service_statuss r r4 z%PAMManager._ensure_status_for_service s
!
4C % - -*3
#f[&9 9 9
j--------- @+NNNt+k** * * * * * * * KK={ K K Kur r c K | j d {V | j | d {V d S r )r waitclearrG r s r r# zPAMManager._status_checker sl )..000000000 #))+++!!###########r c < K | j d S r )r setr s r r$ z!PAMManager._initiate_status_check s! #'')))))r messagec v K t |d t r| j d S d S )Nconf)
isinstancer r rT )r rU s r on_config_updatezPAMManager.on_config_update sA gfo| 4 4 . ' + + - - - - - . .r )r N)__name__
__module__ __qualname___CONFIG_PERIODIC_CHECKr
FromConfigr8 r/ r2 r5 r r& r) rG r r0 r: boolr. r4 r r# r$ r r ConfigUpdaterY r r r
r
s !%F%eX66M"3&"3
(# # 0f /7L M M$6$U,<==L
L L L L
- - - -
"J "J "J "JH=&)&7=EI=
= = = =~ " _Q$ $ $
_+,,* * -,* VK $%%.k.F . . . &%. . .r r
)__doc__r loggingdefence360agent.contractsr defence360agent.contracts.configr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r defence360agent.utilsr r im360.subsysr
r getLoggerrZ rC r
ra r r rk s , , , , , , 9 9 9 9 9 9 : : : : : : A A A A A A A A C C C C C C C C # # # # # # # # 8 $ $Y. Y. Y. Y. Y. Y. Y. Y. Y. Y.r