1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
|
# Wallet::Kadmin::Heimdal -- Wallet Kerberos administration API for Heimdal.
#
# Written by Jon Robertson <jonrober@stanford.edu>
# Copyright 2009, 2010 Board of Trustees, Leland Stanford Jr. University
#
# See LICENSE for licensing terms.
##############################################################################
# Modules and declarations
##############################################################################
package Wallet::Kadmin::Heimdal;
require 5.006;
use strict;
use vars qw(@ISA $VERSION);
use Heimdal::Kadm5 qw(KRB5_KDB_DISALLOW_ALL_TIX);
use Wallet::Config ();
use Wallet::Kadmin ();
@ISA = qw(Wallet::Kadmin);
# This version should be increased on any code change to this module. Always
# use two digits for the minor version with a leading zero if necessary so
# that it will sort properly.
$VERSION = '0.03';
##############################################################################
# Utility functions
##############################################################################
# Add the realm to the end of the principal if no realm is currently present.
sub canonicalize_principal {
my ($self, $principal) = @_;
if ($Wallet::Config::KEYTAB_REALM && $principal !~ /\@/) {
$principal .= '@' . $Wallet::Config::KEYTAB_REALM;
}
return $principal;
}
##############################################################################
# Public interfaces
##############################################################################
# Check whether a given principal already exists in Kerberos. Returns true if
# so, false otherwise.
sub exists {
my ($self, $principal) = @_;
$principal = $self->canonicalize_principal ($principal);
my $kadmin = $self->{client};
my $princdata = eval { $kadmin->getPrincipal ($principal) };
if ($@) {
$self->error ("error getting principal: $@");
return;
}
return $princdata ? 1 : 0;
}
# Create a principal in Kerberos. If there is an error, return undef and set
# the error. Return 1 on success or the principal already existing.
sub create {
my ($self, $principal) = @_;
$principal = $self->canonicalize_principal ($principal);
my $exists = eval { $self->exists ($principal) };
if ($@) {
$self->error ("error adding principal $principal: $@");
return;
}
return 1 if $exists;
# The way Heimdal::Kadm5 works, we create a principal object, create the
# actual principal set inactive, then randomize it and activate it.
#
# TODO - Paranoia makes me want to set the password to something random
# on creation even if it is inactive until after randomized by
# module.
my $kadmin = $self->{client};
eval {
my $princdata = $kadmin->makePrincipal ($principal);
my $attrs = $princdata->getAttributes;
$attrs |= KRB5_KDB_DISALLOW_ALL_TIX;
$princdata->setAttributes ($attrs);
my $password = 'inactive';
$kadmin->createPrincipal ($princdata, $password, 0);
$kadmin->randKeyPrincipal ($principal);
$kadmin->enablePrincipal ($principal);
};
if ($@) {
$self->error ("error adding principal $principal: $@");
return;
}
return 1;
}
# Create a keytab for a principal. Returns the keytab as binary data or undef
# on failure, setting the error.
sub keytab {
my ($self, $principal) = @_;
$principal = $self->canonicalize_principal ($principal);
my $kadmin = $self->{client};
my $file = $Wallet::Config::KEYTAB_TMP . "/keytab.$$";
unlink $file;
my $princdata = eval { $kadmin->getPrincipal ($principal) };
if ($@) {
$self->error ("error creating keytab for $principal: $@");
return;
} elsif (!$princdata) {
$self->error ("error creating keytab for $principal: principal does"
. " not exist");
return;
}
eval { $kadmin->extractKeytab ($princdata, $file) };
if ($@) {
$self->error ("error creating keytab for principal: $@");
return;
}
return $self->read_keytab ($file);
}
# Create a keytab for a principal, randomizing the keys for that principal at
# the same time. Takes the principal and an optional list of encryption types
# to which to limit the keytab. Return the keytab data on success and undef
# on failure. If the keytab creation fails, sets the error.
sub keytab_rekey {
my ($self, $principal, @enctypes) = @_;
$principal = $self->canonicalize_principal ($principal);
# The way Heimdal works, you can only remove enctypes from a principal,
# not add them back in. So we need to run randkeyPrincipal first each
# time to restore all possible enctypes and then whittle them back down
# to those we have been asked for this time.
my $kadmin = $self->{client};
eval { $kadmin->randKeyPrincipal ($principal) };
if ($@) {
$self->error ("error creating keytab for $principal: could not"
. " reinit enctypes: $@");
return;
}
my $princdata = eval { $kadmin->getPrincipal ($principal) };
if ($@) {
$self->error ("error creating keytab for $principal: $@");
return;
} elsif (!$princdata) {
$self->error ("error creating keytab for $principal: principal does"
. " not exist");
return;
}
# Now actually remove any non-requested enctypes, if we requested any.
if (@enctypes) {
my $alltypes = $princdata->getKeytypes;
my %wanted = map { $_ => 1 } @enctypes;
for my $key (@{ $alltypes }) {
my $keytype = $key->[0];
next if exists $wanted{$keytype};
eval { $princdata->delKeytypes ($keytype) };
if ($@) {
$self->error ("error removing keytype $keytype from the"
. " keytab: $@");
return;
}
}
eval { $kadmin->modifyPrincipal ($princdata) };
if ($@) {
$self->error ("error saving principal modifications: $@");
return;
}
}
# Create the keytab.
my $file = $Wallet::Config::KEYTAB_TMP . "/keytab.$$";
unlink $file;
eval { $kadmin->extractKeytab ($princdata, $file) };
if ($@) {
$self->error ("error creating keytab for principal: $@");
return;
}
return $self->read_keytab ($file);
}
# Delete a principal from Kerberos. Return true if successful, false
# otherwise. If the deletion fails, sets the error. If the principal doesn't
# exist, return success; we're bringing reality in line with our expectations.
sub destroy {
my ($self, $principal) = @_;
$principal = $self->canonicalize_principal ($principal);
my $exists = eval { $self->exists ($principal) };
if ($@) {
$self->error ("error checking principal existance: $@");
return;
} elsif (not $exists) {
return 1;
}
my $kadmin = $self->{client};
my $retval = eval { $kadmin->deletePrincipal ($principal) };
if ($@) {
$self->error ("error deleting $principal: $@");
return;
}
return 1;
}
# Create a new Wallet::Kadmin::Heimdal object and its underlying
# Heimdal::Kadm5 object.
sub new {
my ($class) = @_;
unless (defined ($Wallet::Config::KEYTAB_PRINCIPAL)
and defined ($Wallet::Config::KEYTAB_FILE)
and defined ($Wallet::Config::KEYTAB_REALM)) {
die "keytab object implementation not configured\n";
}
unless (defined ($Wallet::Config::KEYTAB_TMP)) {
die "KEYTAB_TMP configuration variable not set\n";
}
my @options = (RaiseError => 1,
Principal => $Wallet::Config::KEYTAB_PRINCIPAL,
Realm => $Wallet::Config::KEYTAB_REALM,
Keytab => $Wallet::Config::KEYTAB_FILE);
if ($Wallet::Config::KEYTAB_HOST) {
push (@options, Server => $Wallet::Config::KEYTAB_HOST);
}
my $client = Heimdal::Kadm5::Client->new (@options);
my $self = { client => $client };
bless ($self, $class);
return $self;
}
1;
__END__
##############################################################################
# Documentation
##############################################################################
=for stopwords
keytabs keytab kadmin KDC API Allbery Heimdal
=head1 NAME
Wallet::Kadmin::Heimdal - Wallet Kerberos administration API for Heimdal
=head1 SYNOPSIS
my $kadmin = Wallet::Kadmin::Heimdal->new;
$kadmin->create ('host/foo.example.com');
$kadmin->keytab_rekey ('host/foo.example.com', 'keytab',
'aes256-cts-hmac-sha1-96');
my $data = $kadmin->keytab ('host/foo.example.com');
my $exists = $kadmin->exists ('host/oldshell.example.com');
$kadmin->destroy ('host/oldshell.example.com') if $exists;
=head1 DESCRIPTION
Wallet::Kadmin::Heimdal implements the Wallet::Kadmin API for Heimdal,
providing an interface to create and delete principals and create keytabs.
It provides the API documented in Wallet::Kadmin(3) for a Heimdal KDC.
To use this class, several configuration parameters must be set. See
L<Wallet::Config/"KEYTAB OBJECT CONFIGURATION"> for details.
=head1 FILES
=over 4
=item KEYTAB_TMP/keytab.<pid>
The keytab is created in this file and then read into memory. KEYTAB_TMP
is set in the wallet configuration, and <pid> is the process ID of the
current process. The file is unlinked after being read.
=back
=head1 SEE ALSO
kadmin(8), Wallet::Config(3), Wallet::Kadmin(3),
Wallet::Object::Keytab(3), wallet-backend(8)
This module is part of the wallet system. The current version is
available from L<http://www.eyrie.org/~eagle/software/wallet/>.
=head1 AUTHORS
Russ Allbery <rra@stanford.edu> and Jon Robertson <jonrober@stanford.edu>.
=cut
|
