X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=FS%2FFS%2Fsvc_acct.pm;h=f7d2fd7dbcc93be4a1fa9753065a32a68069591d;hb=8d6016abb9ca2e9d270d668e9607445921846aaa;hp=a59d8633156b531afeba89e3fb7e1df2161c2589;hpb=24a036da06d8418666d966895aa94cf0675318fd;p=freeside.git diff --git a/FS/FS/svc_acct.pm b/FS/FS/svc_acct.pm index a59d86331..f7d2fd7db 100644 --- a/FS/FS/svc_acct.pm +++ b/FS/FS/svc_acct.pm @@ -2,14 +2,23 @@ package FS::svc_acct; use strict; use vars qw( @ISA $nossh_hack $conf $dir_prefix @shells $usernamemin - $usernamemax $passwordmin - $shellmachine @saltset @pw_set); + $usernamemax $passwordmin $username_letter $username_letterfirst + $username_noperiod + $shellmachine $useradd $usermod $userdel $mydomain + $cyrus_server $cyrus_admin_user $cyrus_admin_pass + @saltset @pw_set); +use Carp; use FS::Conf; -use FS::Record qw( qsearchs fields ); +use FS::Record qw( qsearch qsearchs fields dbh ); use FS::svc_Common; -use FS::SSH qw(ssh); +use Net::SSH qw(ssh); use FS::part_svc; use FS::svc_acct_pop; +use FS::svc_acct_sm; +use FS::cust_main_invoice; +use FS::svc_domain; +use FS::raddb; +use FS::queue; @ISA = qw( FS::svc_Common ); @@ -22,6 +31,40 @@ $FS::UID::callback{'FS::svc_acct'} = sub { $usernamemin = $conf->config('usernamemin') || 2; $usernamemax = $conf->config('usernamemax'); $passwordmin = $conf->config('passwordmin') || 6; + if ( $shellmachine ) { + if ( $conf->exists('shellmachine-useradd') ) { + $useradd = join("\n", $conf->config('shellmachine-useradd') ) + || 'cp -pr /etc/skel $dir; chown -R $uid.$gid $dir'; + } else { + $useradd = 'useradd -d $dir -m -s $shell -u $uid $username'; + } + if ( $conf->exists('shellmachine-userdel') ) { + $userdel = join("\n", $conf->config('shellmachine-userdel') ) + || 'rm -rf $dir'; + } else { + $userdel = 'userdel $username'; + } + $usermod = join("\n", $conf->config('shellmachine-usermod') ) + || '[ -d $old_dir ] && mv $old_dir $new_dir || ( '. + 'chmod u+t $old_dir; mkdir $new_dir; cd $old_dir; '. + 'find . -depth -print | cpio -pdm $new_dir; '. + 'chmod u-t $new_dir; chown -R $uid.$gid $new_dir; '. + 'rm -rf $old_dir'. + ')'; + } + $username_letter = $conf->exists('username-letter'); + $username_letterfirst = $conf->exists('username-letterfirst'); + $username_noperiod = $conf->exists('username-noperiod'); + $mydomain = $conf->config('domain'); + if ( $conf->exists('cyrus') ) { + ($cyrus_server, $cyrus_admin_user, $cyrus_admin_pass) = + $conf->config('cyrus'); + eval "use Cyrus::IMAP::Admin;" + } else { + $cyrus_server = ''; + $cyrus_admin_user = ''; + $cyrus_admin_pass = ''; + } }; @saltset = ( 'a'..'z' , 'A'..'Z' , '0'..'9' , '.' , '/' ); @@ -56,6 +99,10 @@ FS::svc_acct - Object methods for svc_acct records %hash = $record->radius; + %hash = $record->radius_reply; + + %hash = $record->radius_check; + =head1 DESCRIPTION An FS::svc_acct object represents an account. FS::svc_acct inherits from @@ -85,8 +132,14 @@ FS::svc_Common. The following fields are currently supported: =item slipip - IP address +=item seconds - + +=item domsvc - svcnum from svc_domain + =item radius_I - I +=item domsvc - service number of svc_domain with which to associate + =back =head1 METHODS @@ -110,12 +163,24 @@ The additional fields pkgnum and svcpart (see L) should be defined. An FS::cust_svc record will be created and inserted. If the configuration value (see L) shellmachine exists, and the -username, uid, and dir fields are defined, the command +username, uid, and dir fields are defined, the command(s) specified in +the shellmachine-useradd configuration are added to the job queue (see +L and L) to be exectued on shellmachine via ssh. +This behaviour can be surpressed by setting $FS::svc_acct::nossh_hack true. +If the shellmachine-useradd configuration file does not exist, useradd -d $dir -m -s $shell -u $uid $username -is executed on shellmachine via ssh. This behaviour can be surpressed by -setting $FS::svc_acct::nossh_hack true. +is the default. If the shellmachine-useradd configuration file exists but +it empty, + + cp -pr /etc/skel $dir; chown -R $uid.$gid $dir + +is the default instead. Otherwise the contents of the file are treated as +a double-quoted perl string, with the following variables available: +$username, $uid, $gid, $dir, and $shell. + +(TODOC: cyrus config file, L and L) =cut @@ -130,48 +195,90 @@ sub insert { local $SIG{TSTP} = 'IGNORE'; local $SIG{PIPE} = 'IGNORE'; + my $oldAutoCommit = $FS::UID::AutoCommit; + local $FS::UID::AutoCommit = 0; + my $dbh = dbh; + + my $amount = 0; + $error = $self->check; return $error if $error; return "Username ". $self->username. " in use" - if qsearchs( 'svc_acct', { 'username' => $self->username } ); + if qsearchs( 'svc_acct', { 'username' => $self->username, + 'domsvc' => $self->domsvc, + } ); my $part_svc = qsearchs( 'part_svc', { 'svcpart' => $self->svcpart } ); - return "Unkonwn svcpart" unless $part_svc; + return "Unknown svcpart" unless $part_svc; return "uid in use" - if $part_svc->svc_acct__uid_flag ne 'F' + if $part_svc->part_svc_column('uid')->columnflag ne 'F' && qsearchs( 'svc_acct', { 'uid' => $self->uid } ) && $self->username !~ /^(hyla)?fax$/ ; $error = $self->SUPER::insert; - return $error if $error; + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return $error; + } - my ( $username, $uid, $dir, $shell ) = ( + my( $username, $uid, $gid, $dir, $shell ) = ( $self->username, $self->uid, + $self->gid, $self->dir, $self->shell, ); - if ( $username - && $uid - && $dir - && $shellmachine - && ! $nossh_hack ) { - #one way - ssh("root\@$shellmachine", - "useradd -d $dir -m -s $shell -u $uid $username" - ); - #another way - #ssh("root\@$shellmachine","/bin/mkdir $dir; /bin/chmod 711 $dir; ". - # "/bin/cp -p /etc/skel/.* $dir 2>/dev/null; ". - # "/bin/cp -pR /etc/skel/Maildir $dir 2>/dev/null; ". - # "/bin/chown -R $uid $dir") unless $nossh_hack; + if ( $username && $uid && $dir && $shellmachine && ! $nossh_hack ) { + my $queue = new FS::queue { 'job' => 'Net::SSH::ssh' }; + $error = $queue->insert("root\@$shellmachine", eval qq("$useradd") ); + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return "queueing job (transaction rolled back): $error"; + } + } + + if ( $cyrus_server ) { + my $queue = new FS::queue { 'job' => 'FS::svc_acct::cyrus_insert' }; + $error = $queue->insert($self->username, $self->quota); + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return "queueing job (transaction rolled back): $error"; + } } + $dbh->commit or die $dbh->errstr if $oldAutoCommit; ''; #no error } +sub cyrus_insert { + my( $username, $quota ) = + + my $client = Cyrus::IMAP::Admin->new($cyrus_server); + $client->authenticate( + -user => $cyrus_admin_user, + -mechanism => "login", + -password => $cyrus_admin_pass + ); + + my $rc = $client->create("user.$username"); + my $error = $client->error; + die $error if $error; + + $rc = $client->setacl("user.$username", $username => 'all' ); + $error = $client->error; + die $error if $error; + + if ( $quota ) { + $rc = $client->setquota("user.$username", 'STORAGE' => $quota ); + $error = $client->error; + die $error if $error; + } + + 1; +} + =item delete Deletes this account from the database. If there is an error, returns the @@ -179,18 +286,44 @@ error, otherwise returns false. The corresponding FS::cust_svc record will be deleted as well. -If the configuration value (see L) shellmachine exists, the command: +If the configuration value (see L) shellmachine exists, the +command(s) specified in the shellmachine-userdel configuration file are +added to the job queue (see L and L) to be executed +on shellmachine via ssh. This behavior can be surpressed by setting +$FS::svc_acct::nossh_hack true. If the shellmachine-userdel configuration +file does not exist, userdel $username -is executed on shellmachine via ssh. This behaviour can be surpressed by -setting $FS::svc_acct::nossh_hack true. +is the default. If the shellmachine-userdel configuration file exists but +is empty, + + rm -rf $dir + +is the default instead. Otherwise the contents of the file are treated as a +double-quoted perl string, with the following variables available: +$username and $dir. + +(TODOC: cyrus config file) =cut sub delete { my $self = shift; - my $error; + + return "Can't delete an account which has (svc_acct_sm) mail aliases!" + if $self->uid && qsearch( 'svc_acct_sm', { 'domuid' => $self->uid } ); + + return "Can't delete an account which is a (svc_forward) source!" + if qsearch( 'svc_forward', { 'srcsvc' => $self->svcnum } ); + + return "Can't delete an account which is a (svc_forward) destination!" + if qsearch( 'svc_forward', { 'dstsvc' => $self->svcnum } ); + + return "Can't delete an account with (svc_www) web service!" + if qsearch( 'svc_www', { 'usersvc' => $self->usersvc } ); + + # what about records in session ? local $SIG{HUP} = 'IGNORE'; local $SIG{INT} = 'IGNORE'; @@ -199,28 +332,104 @@ sub delete { local $SIG{TSTP} = 'IGNORE'; local $SIG{PIPE} = 'IGNORE'; - $error = $self->SUPER::delete; - return $error if $error; + my $oldAutoCommit = $FS::UID::AutoCommit; + local $FS::UID::AutoCommit = 0; + my $dbh = dbh; - my $username = $self->username; + foreach my $cust_main_invoice ( + qsearch( 'cust_main_invoice', { 'dest' => $self->svcnum } ) + ) { + my %hash = $cust_main_invoice->hash; + $hash{'dest'} = $self->email; + my $new = new FS::cust_main_invoice \%hash; + my $error = $new->replace($cust_main_invoice); + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return $error; + } + } + + foreach my $svc_domain ( + qsearch( 'svc_domain', { 'catchall' => $self->svcnum } ) + ) { + my %hash = new FS::svc_domain->hash; + $hash{'catchall'} = ''; + my $new = new FS::svc_domain \%hash; + my $error = $new->replace($svc_domain); + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return $error; + } + } + + my $error = $self->SUPER::delete; + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return $error; + } + + my( $username, $dir ) = ( + $self->username, + $self->dir, + ); if ( $username && $shellmachine && ! $nossh_hack ) { - ssh("root\@$shellmachine","userdel $username"); + my $queue = new FS::queue { 'job' => 'Net::SSH::ssh' }; + $error = $queue->insert("root\@$shellmachine", eval qq("$userdel") ); + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return "queueing job (transaction rolled back): $error"; + } + + } + + if ( $cyrus_server ) { + my $queue = new FS::queue { 'job' => 'FS::svc_acct::cyrus_delete' }; + $error = $queue->insert($self->username); + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return "queueing job (transaction rolled back): $error"; + } } + $dbh->commit or die $dbh->errstr if $oldAutoCommit; ''; } +sub cyrus_delete { + my( $username ) = shift; + + my $client = Cyrus::IMAP::Admin->new($cyrus_server); + $client->authenticate( + -user => $cyrus_admin_user, + -mechanism => "login", + -password => $cyrus_admin_pass + ); + + my $rc = $client->setacl("user.$username", $cyrus_admin_user => 'all' ); + my $error = $client->error; + die $error if $error; + + $rc = $client->delete("user.$username"); + $error = $client->error; + die $error if $error; + + 1; +} + =item replace OLD_RECORD Replaces OLD_RECORD with this one in the database. If there is an error, returns the error, otherwise returns false. If the configuration value (see L) shellmachine exists, and the -dir field has changed, the command: +dir field has changed, the command(s) specified in the shellmachine-usermod +configuraiton file are added to the job queue (see L and +L) to be executed on shellmachine via ssh. This behavior can +be surpressed by setting $FS::svc-acct::nossh_hack true. If the +shellmachine-userdel configuration file does not exist or is empty, - [ -d $old_dir ] && ( + [ -d $old_dir ] && mv $old_dir $new_dir || ( chmod u+t $old_dir; - umask 022; mkdir $new_dir; cd $old_dir; find . -depth -print | cpio -pdm $new_dir; @@ -229,8 +438,8 @@ dir field has changed, the command: rm -rf $old_dir ) -is executed on shellmachine via ssh. This behaviour can be surpressed by -setting $FS::svc_acct::nossh_hack true. +is the default. This behaviour can be surpressed by setting +$FS::svc_acct::nossh_hack true. =cut @@ -244,6 +453,9 @@ sub replace { return "Can't change uid!" if $old->uid != $new->uid; + return "can't change username using Cyrus" + if $cyrus_server && $old->username ne $new->username; + #change homdir when we change username $new->setfield('dir', '') if $old->username ne $new->username; @@ -254,26 +466,32 @@ sub replace { local $SIG{TSTP} = 'IGNORE'; local $SIG{PIPE} = 'IGNORE'; + my $oldAutoCommit = $FS::UID::AutoCommit; + local $FS::UID::AutoCommit = 0; + my $dbh = dbh; + $error = $new->SUPER::replace($old); - return $error if $error; + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return $error if $error; + } - my ( $old_dir, $new_dir ) = ( $old->getfield('dir'), $new->getfield('dir') ); - my ( $uid, $gid) = ( $new->getfield('uid'), $new->getfield('gid') ); - if ( $old_dir - && $new_dir - && $old_dir ne $new_dir - && ! $nossh_hack - ) { - ssh("root\@$shellmachine","[ -d $old_dir ] && ". - "( chmod u+t $old_dir; ". #turn off qmail delivery - "umask 022; mkdir $new_dir; cd $old_dir; ". - "find . -depth -print | cpio -pdm $new_dir; ". - "chmod u-t $new_dir; chown -R $uid.$gid $new_dir; ". - "rm -rf $old_dir". - ")" - ); + my ( $old_dir, $new_dir, $uid, $gid ) = ( + $old->getfield('dir'), + $new->getfield('dir'), + $new->getfield('uid'), + $new->getfield('gid'), + ); + if ( $old_dir && $new_dir && $old_dir ne $new_dir && ! $nossh_hack ) { + my $queue = new FS::queue { 'job' => 'Net::SSH::ssh' }; + $error = $queue->insert("root\@$shellmachine", eval qq("$usermod") ); + if ( $error ) { + $dbh->rollback if $oldAutoCommit; + return "queueing job (transaction rolled back): $error"; + } } + $dbh->commit or die $dbh->errstr if $oldAutoCommit; ''; #no error } @@ -344,19 +562,31 @@ sub check { return $x unless ref($x); my $part_svc = $x; + my $error = $self->ut_numbern('svcnum') + || $self->ut_number('domsvc') + ; + return $error if $error; + my $ulen = $usernamemax || $self->dbdef_table->column('username')->length; $recref->{username} =~ /^([a-z0-9_\-\.]{$usernamemin,$ulen})$/ or return "Illegal username"; $recref->{username} = $1; - $recref->{username} =~ /[a-z]/ or return "Illegal username"; + if ( $username_letterfirst ) { + $recref->{username} =~ /^[a-z]/ or return "Illegal username"; + } elsif ( $username_letter ) { + $recref->{username} =~ /[a-z]/ or return "Illegal username"; + } + if ( $username_noperiod ) { + $recref->{username} =~ /\./ and return "Illegal username"; + } $recref->{popnum} =~ /^(\d*)$/ or return "Illegal popnum: ".$recref->{popnum}; $recref->{popnum} = $1; - return "Unkonwn popnum" unless + return "Unknown popnum" unless ! $recref->{popnum} || qsearchs('svc_acct_pop',{'popnum'=> $recref->{popnum} } ); - unless ( $part_svc->getfield('svc_acct__uid_flag') eq 'F' ) { + unless ( $part_svc->part_svc_column('uid')->columnflag eq 'F' ) { $recref->{uid} =~ /^(\d*)$/ or return "Illegal uid"; $recref->{uid} = $1 eq '' ? $self->unique('uid') : $1; @@ -369,8 +599,8 @@ sub check { return "Only root can have uid 0" if $recref->{uid} == 0 && $recref->{username} ne 'root'; - my($error); - return $error if $error=$self->ut_textn('finger'); + $error = $self->ut_textn('finger'); + return $error if $error; $recref->{dir} =~ /^([\/\w\-]*)$/ or return "Illegal directory"; @@ -406,7 +636,7 @@ sub check { return "Can't have quota without uid" : ( $recref->{quota}='' ); } - unless ( $part_svc->getfield('svc_acct__slipip_flag') eq 'F' ) { + unless ( $part_svc->part_svc_column('slipip')->columnflag eq 'F' ) { unless ( $recref->{slipip} eq '0e0' ) { $recref->{slipip} =~ /^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/ or return "Illegal slipip". $self->slipip; @@ -440,6 +670,8 @@ sub check { $recref->{_password} = $1.$3; } elsif ( $recref->{_password} eq '*' ) { $recref->{_password} = '*'; + } elsif ( $recref->{_password} eq '!!' ) { + $recref->{_password} = '!!'; } else { return "Illegal password"; } @@ -449,8 +681,19 @@ sub check { =item radius +Depriciated, use radius_reply instead. + +=cut + +sub radius { + carp "FS::svc_acct::radius depriciated, use radius_reply"; + $_[0]->radius_reply; +} + +=item radius_reply + Returns key/value pairs, suitable for assigning to a hash, for any RADIUS -attributes of this record. +reply attributes of this record. Note that this is now the preferred method for reading RADIUS attributes - accessing the columns directly is discouraged, as the column names are @@ -458,27 +701,74 @@ expected to change in the future. =cut -sub radius { +sub radius_reply { my $self = shift; map { /^(radius_(.*))$/; my($column, $attrib) = ($1, $2); - $attrib =~ s/_/\-/g; - ( $attrib, $self->getfield($column) ); + #$attrib =~ s/_/\-/g; + ( $FS::raddb::attrib{lc($attrib)}, $self->getfield($column) ); } grep { /^radius_/ && $self->getfield($_) } fields( $self->table ); } +=item radius_check + +Returns key/value pairs, suitable for assigning to a hash, for any RADIUS +check attributes of this record. + +Accessing RADIUS attributes directly is not supported and will break in the +future. + +=cut + +sub radius_check { + my $self = shift; + map { + /^(rc_(.*))$/; + my($column, $attrib) = ($1, $2); + #$attrib =~ s/_/\-/g; + ( $FS::raddb::attrib{lc($attrib)}, $self->getfield($column) ); + } grep { /^rc_/ && $self->getfield($_) } fields( $self->table ); +} + +=item domain + +Returns the domain associated with this account. + +=cut + +sub domain { + my $self = shift; + if ( $self->domsvc ) { + my $svc_domain = qsearchs( 'svc_domain', { 'svcnum' => $self->domsvc } ) + or die "no svc_domain.svcnum for svc_acct.domsvc ". $self->domsvc; + $svc_domain->domain; + } else { + $mydomain or die "svc_acct.domsvc is null and no legacy domain config file"; + } +} + +=item email + +Returns an email address associated with the account. + +=cut + +sub email { + my $self = shift; + $self->username. '@'. $self->domain; +} + =back =head1 VERSION -$Id: svc_acct.pm,v 1.8 2000-07-04 13:42:37 ivan Exp $ +$Id: svc_acct.pm,v 1.35 2001-09-11 04:17:47 ivan Exp $ =head1 BUGS -The remote commands should be configurable. - -The bits which ssh should fork before doing so. +The bits which ssh should fork before doing so (or maybe queue jobs for a +daemon). The $recref stuff in sub check should be cleaned up. @@ -489,7 +779,8 @@ counterintuitive. =head1 SEE ALSO L, L, L, L, -L, L, L, L, L, +L, L, L, L), +L, L, L, schema.html from the base documentation. =cut