a ì)gjã@sddlmZmZmZeZdZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlmZmZddlmZddlmZddlmZmZmZmZddlmZmZdd lmZdd lm Z dd l!m"Z"dd l#m$Z$m%Z%m&Z&e ƒZ'd Z(e  )d¡Z*Gdd„de+ƒZ,iZ-iZ.Gdd„deƒZ/dS)é)Úabsolute_importÚdivisionÚprint_functionaN author: Ansible Core Team name: paramiko short_description: Run tasks via python ssh (paramiko) description: - Use the python ssh implementation (Paramiko) to connect to targets - The paramiko transport is provided because many distributions, in particular EL6 and before do not support ControlPersist in their SSH implementations. - This is needed on the Ansible control machine to be reasonably efficient with connections. Thus paramiko is faster for most users on these platforms. Users with ControlPersist capability can consider using -c ssh or configuring the transport in the configuration file. - This plugin also borrows a lot of settings from the ssh plugin as they both cover the same protocol. version_added: "0.1" options: remote_addr: description: - Address of the remote target default: inventory_hostname vars: - name: inventory_hostname - name: ansible_host - name: ansible_ssh_host - name: ansible_paramiko_host remote_user: description: - User to login/authenticate as - Can be set from the CLI via the C(--user) or C(-u) options. vars: - name: ansible_user - name: ansible_ssh_user - name: ansible_paramiko_user env: - name: ANSIBLE_REMOTE_USER - name: ANSIBLE_PARAMIKO_REMOTE_USER version_added: '2.5' ini: - section: defaults key: remote_user - section: paramiko_connection key: remote_user version_added: '2.5' keyword: - name: remote_user password: description: - Secret used to either login the ssh server or as a passphrase for ssh keys that require it - Can be set from the CLI via the C(--ask-pass) option. vars: - name: ansible_password - name: ansible_ssh_pass - name: ansible_ssh_password - name: ansible_paramiko_pass - name: ansible_paramiko_password version_added: '2.5' use_rsa_sha2_algorithms: description: - Whether or not to enable RSA SHA2 algorithms for pubkeys and hostkeys - On paramiko versions older than 2.9, this only affects hostkeys - For behavior matching paramiko<2.9 set this to C(False) vars: - name: ansible_paramiko_use_rsa_sha2_algorithms ini: - {key: use_rsa_sha2_algorithms, section: paramiko_connection} env: - {name: ANSIBLE_PARAMIKO_USE_RSA_SHA2_ALGORITHMS} default: True type: boolean version_added: '2.14' host_key_auto_add: description: 'Automatically add host keys' env: [{name: ANSIBLE_PARAMIKO_HOST_KEY_AUTO_ADD}] ini: - {key: host_key_auto_add, section: paramiko_connection} type: boolean look_for_keys: default: True description: 'False to disable searching for private key files in ~/.ssh/' env: [{name: ANSIBLE_PARAMIKO_LOOK_FOR_KEYS}] ini: - {key: look_for_keys, section: paramiko_connection} type: boolean proxy_command: default: '' description: - Proxy information for running the connection via a jumphost - Also this plugin will scan 'ssh_args', 'ssh_extra_args' and 'ssh_common_args' from the 'ssh' plugin settings for proxy information if set. env: [{name: ANSIBLE_PARAMIKO_PROXY_COMMAND}] ini: - {key: proxy_command, section: paramiko_connection} ssh_args: description: Only used in parsing ProxyCommand for use in this plugin. default: '' ini: - section: 'ssh_connection' key: 'ssh_args' env: - name: ANSIBLE_SSH_ARGS vars: - name: ansible_ssh_args version_added: '2.7' ssh_common_args: description: Only used in parsing ProxyCommand for use in this plugin. ini: - section: 'ssh_connection' key: 'ssh_common_args' version_added: '2.7' env: - name: ANSIBLE_SSH_COMMON_ARGS version_added: '2.7' vars: - name: ansible_ssh_common_args cli: - name: ssh_common_args default: '' ssh_extra_args: description: Only used in parsing ProxyCommand for use in this plugin. vars: - name: ansible_ssh_extra_args env: - name: ANSIBLE_SSH_EXTRA_ARGS version_added: '2.7' ini: - key: ssh_extra_args section: ssh_connection version_added: '2.7' cli: - name: ssh_extra_args default: '' pty: default: True description: 'SUDO usually requires a PTY, True to give a PTY and False to not give a PTY.' env: - name: ANSIBLE_PARAMIKO_PTY ini: - section: paramiko_connection key: pty type: boolean record_host_keys: default: True description: 'Save the host keys to a file' env: [{name: ANSIBLE_PARAMIKO_RECORD_HOST_KEYS}] ini: - section: paramiko_connection key: record_host_keys type: boolean host_key_checking: description: 'Set this to "False" if you want to avoid host key checking by the underlying tools Ansible uses to connect to the host' type: boolean default: True env: - name: ANSIBLE_HOST_KEY_CHECKING - name: ANSIBLE_SSH_HOST_KEY_CHECKING version_added: '2.5' - name: ANSIBLE_PARAMIKO_HOST_KEY_CHECKING version_added: '2.5' ini: - section: defaults key: host_key_checking - section: paramiko_connection key: host_key_checking version_added: '2.5' vars: - name: ansible_host_key_checking version_added: '2.5' - name: ansible_ssh_host_key_checking version_added: '2.5' - name: ansible_paramiko_host_key_checking version_added: '2.5' use_persistent_connections: description: 'Toggles the use of persistence for connections' type: boolean default: False env: - name: ANSIBLE_USE_PERSISTENT_CONNECTIONS ini: - section: defaults key: use_persistent_connections banner_timeout: type: float default: 30 version_added: '2.14' description: - Configures, in seconds, the amount of time to wait for the SSH banner to be presented. This option is supported by paramiko version 1.15.0 or newer. ini: - section: paramiko_connection key: banner_timeout env: - name: ANSIBLE_PARAMIKO_BANNER_TIMEOUT # TODO: #timeout=self._play_context.timeout, N)ÚtcflushÚTCIFLUSH)Ú LooseVersion)Úhexlify)ÚAnsibleAuthenticationFailureÚAnsibleConnectionFailureÚ AnsibleErrorÚAnsibleFileNotFound)ÚPARAMIKO_IMPORT_ERRÚparamiko)ÚConnectionBase)ÚDisplay)Ú makedirs_safe)Úto_bytesÚ to_nativeÚto_textz” paramiko: The authenticity of host '%s' can't be established. The %s key fingerprint is %s. Are you sure you want to continue connecting (yes/no)? z(\w+)(?:\s*=\s*|\s+)(.+)c@s eZdZdZdd„Zdd„ZdS)Ú MyAddPolicya  Based on AutoAddPolicy in paramiko so we can determine when keys are added and also prompt for input. Policy for automatically adding the hostname and new host key to the local L{HostKeys} object, and saving it. This is used by L{SSHClient}. cCs||_||_|j|_dS©N)Ú _new_stdinÚ connectionÚ_options)ÚselfZ new_stdinr©rúK/usr/lib/python3.9/site-packages/ansible/plugins/connection/paramiko_ssh.pyÚ__init__øszMyAddPolicy.__init__cCsÐt|jd|jd fƒr²t| ¡ƒ}| ¡}|j d¡sB|jjr\tt dd…|||fƒ‚|j  ¡t j }|j t _ tt j tƒtt |||fƒ}|t _ |j ¡|dvr²tdƒ‚d|_|j || ¡|¡dS) NÚhost_key_checkingZhost_key_auto_addZuse_persistent_connectionséé\)ZyesÚyÚz host connection rejected by userT)ÚallrrZget_fingerprintZget_namerÚ get_optionZforce_persistencer ÚAUTHENTICITY_MSGZconnection_lockÚsysÚstdinrrrÚinputZconnection_unlockÚ_added_by_ansible_this_timeÚ _host_keysÚadd)rZclientÚhostnameÚkeyZ fingerprintZktypeZ old_stdinÚinprrrÚmissing_host_keyýs     zMyAddPolicy.missing_host_keyN)Ú__name__Ú __module__Ú __qualname__Ú__doc__rr/rrrrrîs rcs”eZdZdZdZdZdd„Zdd„Zdd „Zd d d „Z d d„Z d!‡fdd„ Z ‡fdd„Z dd„Z ‡fdd„Zdd„Zdd„Zdd„Zdd„Z‡ZS)"Ú Connectionz% SSH based connections with Paramiko rNcCsd|jj|jjfS©Nz%s__%s__)Ú _play_contextÚ remote_addrÚ remote_user©rrrrÚ _cache_key.szConnection._cache_keycCs8| ¡}|tvrt||_n| ¡|_t|<d|_|S)NT)r:ÚSSH_CONNECTION_CACHEÚsshÚ_connect_uncachedÚ _connected)rÚ cache_keyrrrÚ_connect1s  zConnection._connectcCs ||_dS)z(Mimic paramiko.SSHClient.set_log_channelN)Ú _log_channel)rÚnamerrrÚ_set_log_channel;szConnection._set_log_channeléc Cs*d}| d¡| d¡| dd¡g}| d |¡¡}t|ƒD]T\}}| ¡dkr\||d}n*t |¡}|r†| d¡ ¡dkr†| d¡}|r:qq:| d ¡pœ|}i}|r&|jj ||jj d œ} |   ¡D]\} } |  | t | ƒ¡}qÄz(d t |¡i}tjd ||jj d Wnty$t d¡Yn0|S)NZssh_extra_argsZssh_common_argsÚssh_argsr"ú Z proxycommandréÚ proxy_command)z%hz%pz%rZsockz*CONFIGURE PROXY COMMAND FOR CONNECTION: %s©ÚhostzwParamiko ProxyCommand support unavailable. Please upgrade to Paramiko 1.9.0 or newer. Not using configured ProxyCommand)r$Z_split_ssh_argsÚjoinÚ enumerateÚlowerÚSETTINGS_REGEXÚmatchÚgroupr6r7r8ÚitemsÚreplaceÚstrrZ ProxyCommandÚdisplayÚvvvÚAttributeErrorZwarning) rÚportrHrEÚargsÚiÚargrOZ sock_kwargZ replacersÚfindrRrrrÚ_parse_proxy_command?s< ý   ýzConnection._parse_proxy_commandc Csðtdurtdttƒƒ‚|jjp"d}tjd|jj||jj f|jj dt  ¡}t tj ddƒ}t tj ddƒ}|  d ¡}i}|s²|r˜td d „|Dƒƒ|d <|r²td d „|Dƒƒ|d<|jdurÈ| |j¡tj d¡|_|  d¡r dD]0}z| |¡WqWqætyYqæ0qæ| ¡| |¡}| t|j|ƒ¡|  d¡pN|jj} d} | durbd} zžd} |jjr‚tj |jj¡} ttjƒtdƒkr¢|jj|d<ttjƒtdƒkrÄ|  d¡|d<|j |jj  !¡f|jj| |  d¡| | |jj||dœ|¤ŽWnêtj"j#y8} zt$d| j%ƒ‚WYd} ~ n¼d} ~ 0tj"j&yv} z"d 't(| ƒ¡} t)| ƒ‚WYd} ~ n~d} ~ 0t*yê} z\t(| ƒ} d| vr¢tdƒ‚n4d| vrÎd |jj|jj || f} t$| ƒ‚nt$| ƒ‚WYd} ~ n d} ~ 00|S)!z! activates the connection object Nzparamiko is not installed: %srDz?ESTABLISH PARAMIKO SSH CONNECTION FOR USER: %s on PORT %s TO %srIZ_preferred_pubkeysrZ_preferred_keysÚuse_rsa_sha2_algorithmscss|]}d|vr|VqdS©zrsa-sha2Nr©Ú.0ÚarrrÚ €óz/Connection._connect_uncached..Zpubkeyscss|]}d|vr|VqdSr^rr_rrrrb‚rcÚkeysz~/.ssh/known_hostsr)z/etc/ssh/ssh_known_hostsz/etc/openssh/ssh_known_hostsÚpasswordTFz2.2.0Z auth_timeoutz1.15.0Zbanner_timeoutÚ look_for_keys)ÚusernameÚ allow_agentrfÚ key_filenamereÚtimeoutrWÚdisabled_algorithmszhost key mismatch for %szFailed to authenticate: {0}zPID check failedzNparamiko version issue, please upgrade paramiko on the machine running ansiblezPrivate key file is encryptedzDssh %s@%s:%s : %s To connect as a different user, use -u .)+rr rr r6rWrTrUr8r7Z SSHClientÚgetattrZ Transportr$ÚtuplerAZset_log_channelÚosÚpathÚ expanduserÚkeyfileÚload_system_host_keysÚIOErrorr\Zset_missing_host_key_policyrrreZprivate_key_filerÚ __version__rjZconnectrMZ ssh_exceptionZBadHostKeyExceptionr r,ZAuthenticationExceptionÚformatrr Ú Exception)rrWr<Zparamiko_preferred_pubkeysZparamiko_preferred_hostkeysr]rkZssh_known_hostsZssh_connect_kwargsZ conn_passwordrhriÚeÚmsgrrrr=lsŽ ÿ           ÿ÷ ö "   ÿ zConnection._connect_uncachedTc s”tt|ƒj|||d|r"tdƒ‚d}z"|j ¡ d¡|j ¡ ¡}WnLty”}z4t |ƒ}d}|rt|d|7}t t |ƒƒ‚WYd}~n d}~00|  d¡rÔ|rÔ|j t d d ¡tt d d ¡ƒtt d d ¡ƒdtjd||jjdt|dd}d} d} d} z2| |¡|jr4|j ¡r4d} d} | sâ| sât d¡| |¡}t d|¡|s’d| vrât |jj d|jdƒ}td|ƒ‚nqâ| |7} |  d¡D]8}|j |¡rÂd} q,n|j |¡r¤d} q,q¤q,| r$|jr|jj d|jd}| t|ddd¡ntdƒ‚n| | 7} | | 7} Wn"tjyXtd| ƒ‚Yn0d  | !d |¡¡}d  | "d |¡¡}| #¡| || |fS)!z" run a command on the remote host )Úin_dataÚsudoablezHInternal Error: this module does not support optimized module pipeliningiézFailed to open sessionz: %sNZptyZTERMZvt100ÚCOLUMNSrÚLINES)ZtermÚwidthZheightzEXEC %srIÚsurrogate_or_strict©ÚerrorsrcFz&Waiting for Privilege Escalation inputz chunk is: %ss unknown userZ become_user)Z playcontextzuser %s does not existTÚ become_passó z,A password is required but none was suppliedz0ssh timed out waiting for privilege escalation. Úrb)$Úsuperr4Ú exec_commandr r<Z get_transportZ set_keepaliveZ open_sessionrvrr rr$Zget_ptyrnÚgetenvÚintrTrUr6r7rZbecomeZ expect_promptÚdebugZrecvÚ splitlinesZ check_successZcheck_password_promptZsendallÚsocketrjrKZmakefileZmakefile_stderrZrecv_exit_status)rÚcmdryrzÚbufsizeZchanrwZtext_erxZ no_prompt_outZ no_prompt_errZ become_outputZ passpromptZ become_sucessÚchunkZ n_become_userÚlr‚ÚstdoutÚstderr©Ú __class__rrr†Êsp "0       ÿ  zConnection.exec_commandc sÔtt|ƒ ||¡tjd||f|jjdtj  t |dd¡sLt d|ƒ‚z|j   ¡|_Wn0tyŒ}ztd|ƒ‚WYd}~n d}~00z"|j t |ddt |dd¡WntyÎtd|ƒ‚Yn0dS) z& transfer a file from local to remote z PUT %s TO %srIrr€z!file or module does not exist: %sú%failed to open a SFTP connection (%s)Nzfailed to transfer file to %s)r…r4Úput_filerTrUr6r7rnroÚexistsrr r<Ú open_sftpÚsftprvr Zputrs©rZin_pathZout_pathrwr’rrr•s "" zConnection.put_filecCsBd|jj|jjf}|tvr$t|S| ¡j ¡}t|<|SdSr5)r6r7r8ÚSFTP_CONNECTION_CACHEr@r<r—)rr?ÚresultrrrÚ _connect_sftp/s zConnection._connect_sftpc s¶tt|ƒ ||¡tjd||f|jjdz| ¡|_Wn4t yn}zt dt |ƒƒ‚WYd}~n d}~00z"|j  t |ddt |dd¡Wnty°t d|ƒ‚Yn0dS)z* save a remote file to the specified path zFETCH %s TO %srIr”Nrr€zfailed to transfer file from %s)r…r4Ú fetch_filerTrUr6r7rœr˜rvr rÚgetrrsr™r’rrr8s&" zConnection.fetch_filecCsD|jj ¡D]2\}}| ¡D] \}}t|ddƒ}|rdSqq dS)Nr)FT)r<r*rQrl)rr,rdÚkeytyper-Úadded_this_timerrrÚ_any_keys_addedIs   zConnection._any_keys_addedc Csî| ¡s dStj d¡}t|ƒt|dƒ°}|jj ¡D]B\}}| ¡D]0\}}t |ddƒ}|sH|  d|||  ¡f¡qHq8|jj ¡D]B\}}| ¡D]0\}}t |ddƒ}|r˜|  d|||  ¡f¡q˜qˆWdƒn1sà0YdS)z not using the paramiko save_ssh_host_keys function as we want to add new SSH keys at the bottom so folks don't complain about it :) Fz~/.sshÚwr)z %s %s %s N) r¡rnrorprÚopenr<r*rQrlÚwriteZ get_base64) rÚfilenameroÚfr,rdrŸr-r rrrÚ_save_ssh_host_keysRs    zConnection._save_ssh_host_keyscCs|js dS| ¡| ¡dSr)r>Úcloser@r9rrrÚresetpszConnection.resetc Cs | ¡}t |d¡t |d¡t|dƒr>|jdur>|j ¡| d¡rŒ| d¡rŒ| ¡rŒ|j   dd¡}t j   |j ¡}t|ƒt|dƒ}t |tj¡zÄ|j ¡|jj |jj¡t j   |j ¡}t j  |j ¡röt  |j ¡}|j}|j}|j} nd}t  ¡}t  ¡} tj |d d } t  !| j"|d @¡t  #| j"|| ¡| $| j"¡|  ¡t  %| j"|j ¡Wnt&y|t' (¡Yn0t |tj)¡|j ¡d |_*dS) z terminate the connection Nr˜rZrecord_host_keysZ known_hostsz.known_hosts.lockr¢i¤F)ÚdirÚdeleteiÿ)+r:r;ÚpopršÚhasattrr˜r¨r$r¡rqrRrnroÚdirnamerr£ÚfcntlÚlockfZLOCK_EXr<rrr*ÚupdateZ_system_host_keysr–ÚstatÚst_modeÚst_uidÚst_gidÚgetuidÚgetgidÚtempfileZNamedTemporaryFileÚchmodrBÚchownr§ÚrenamervÚ tracebackÚ print_excZLOCK_UNr>) rr?Zlockfiler®ZKEY_LOCKZkey_dirZkey_statÚmodeÚuidÚgidZ tmp_keyfilerrrr¨vsF     "     zConnection.close)rD)NT)r0r1r2r3Z transportrAr:r@rCr\r=r†r•rœrr¡r§r©r¨Ú __classcell__rrr’rr4(s   -^Q   r4)0Z __future__rrrÚtypeZ __metaclass__Z DOCUMENTATIONrnr‹r¸r¼r¯r&ÚreZtermiosrrZ#ansible.module_utils.compat.versionrZbinasciirZansible.errorsr r r r Z$ansible.module_utils.compat.paramikor rZansible.plugins.connectionrZansible.utils.displayrZansible.utils.pathrZansible.module_utils._textrrrrTr%ÚcompilerNÚobjectrr;ršr4rrrrÚs4C      6