feat: add invalid_users directive for Samba shares
Samba shares now support an 'invalid users' list (deny list), written as 'invalid users = u1,u2' in smb.conf. The UI shows a ChipPicker for valid_users and invalid_users, mutually exclusive, sourced from the system user list. feat: add ImportSystemUsers for fresh installations When NASCTL_IMPORT_ON_BOOT=true, nasctl now imports existing system users from /etc/passwd (UID 1000-60000) and /etc/group (supplemental groups), and detects which have Samba accounts via 'pdbedit -L'. Imported users are marked dirty so the admin can review before applying. New POST /api/import/users endpoint for manual re-import. This mirrors the existing import-on-boot flow for smb.conf and /etc/exports.
This commit is contained in:
@@ -8,34 +8,42 @@ import (
|
||||
"github.com/darroyo/nasctl/internal/db"
|
||||
"github.com/darroyo/nasctl/internal/modules/nfs"
|
||||
"github.com/darroyo/nasctl/internal/modules/samba"
|
||||
"github.com/darroyo/nasctl/internal/modules/users"
|
||||
)
|
||||
|
||||
type ImportResult struct {
|
||||
SambaImported int
|
||||
NFSImported int
|
||||
UsersImported int
|
||||
SambaSkipped bool
|
||||
NFSSkipped bool
|
||||
NFSSkipped bool
|
||||
UsersSkipped bool
|
||||
SambaError string
|
||||
NFSError string
|
||||
UsersError string
|
||||
}
|
||||
|
||||
type ImporterDB interface {
|
||||
ListSambaShares() ([]db.SambaShare, error)
|
||||
ListNFSExports() ([]db.NFSExport, error)
|
||||
ListUsers() ([]db.User, error)
|
||||
ReplaceSambaShares(shares []db.SambaShare) error
|
||||
ReplaceNFSExports(exports []db.NFSExport) error
|
||||
ReplaceUsers(users []db.User) error
|
||||
GetSetting(key string) (string, bool, error)
|
||||
SetSetting(key, value string) error
|
||||
MarkDirty(module string) error
|
||||
}
|
||||
|
||||
func ImportOnBoot(ctx context.Context, database ImporterDB, smbPath, exportsPath string) ImportResult {
|
||||
func ImportOnBoot(ctx context.Context, database ImporterDB, smbPath, exportsPath, adminUsername string) ImportResult {
|
||||
result := ImportResult{}
|
||||
|
||||
sambaDone, _, _ := database.GetSetting("import.samba.done")
|
||||
nfsDone, _, _ := database.GetSetting("import.nfs.done")
|
||||
usersDone, _, _ := database.GetSetting("import.users.done")
|
||||
|
||||
if sambaDone == "true" && nfsDone == "true" {
|
||||
allDone := sambaDone == "true" && nfsDone == "true" && usersDone == "true"
|
||||
if allDone {
|
||||
return result
|
||||
}
|
||||
|
||||
@@ -59,8 +67,19 @@ func ImportOnBoot(ctx context.Context, database ImporterDB, smbPath, exportsPath
|
||||
}
|
||||
}
|
||||
|
||||
if result.SambaImported > 0 || result.NFSImported > 0 {
|
||||
log.Printf("[importer] imported %d samba shares, %d nfs exports", result.SambaImported, result.NFSImported)
|
||||
if usersDone != "true" {
|
||||
ur := importUsers(ctx, database, adminUsername)
|
||||
result.UsersImported = ur.count
|
||||
result.UsersSkipped = ur.skipped
|
||||
result.UsersError = ur.err
|
||||
if ur.err == "" {
|
||||
_ = database.SetSetting("import.users.done", "true")
|
||||
}
|
||||
}
|
||||
|
||||
if result.SambaImported > 0 || result.NFSImported > 0 || result.UsersImported > 0 {
|
||||
log.Printf("[importer] imported %d samba shares, %d nfs exports, %d users",
|
||||
result.SambaImported, result.NFSImported, result.UsersImported)
|
||||
}
|
||||
|
||||
return result
|
||||
@@ -69,13 +88,14 @@ func ImportOnBoot(ctx context.Context, database ImporterDB, smbPath, exportsPath
|
||||
func ResetImportFlags(ctx context.Context, database ImporterDB) error {
|
||||
_ = database.SetSetting("import.samba.done", "")
|
||||
_ = database.SetSetting("import.nfs.done", "")
|
||||
_ = database.SetSetting("import.users.done", "")
|
||||
return nil
|
||||
}
|
||||
|
||||
type importStep struct {
|
||||
count int
|
||||
count int
|
||||
skipped bool
|
||||
err string
|
||||
err string
|
||||
}
|
||||
|
||||
func importSamba(ctx context.Context, database ImporterDB, path string) importStep {
|
||||
@@ -133,3 +153,31 @@ func importNFS(ctx context.Context, database ImporterDB, path string) importStep
|
||||
|
||||
return importStep{count: len(exports)}
|
||||
}
|
||||
|
||||
func importUsers(ctx context.Context, database ImporterDB, adminUsername string) importStep {
|
||||
imported, err := ImportSystemUsers(ctx, adminUsername)
|
||||
if err != nil {
|
||||
return importStep{err: err.Error()}
|
||||
}
|
||||
if imported == nil {
|
||||
return importStep{skipped: true}
|
||||
}
|
||||
|
||||
existing, err := database.ListUsers()
|
||||
if err != nil {
|
||||
return importStep{err: err.Error()}
|
||||
}
|
||||
if len(existing) > 0 {
|
||||
return importStep{skipped: true}
|
||||
}
|
||||
|
||||
if err := database.ReplaceUsers(imported); err != nil {
|
||||
return importStep{err: err.Error()}
|
||||
}
|
||||
|
||||
if err := database.MarkDirty(users.ModuleName); err != nil {
|
||||
return importStep{count: len(imported), err: fmt.Sprintf("imported but could not mark dirty: %v", err)}
|
||||
}
|
||||
|
||||
return importStep{count: len(imported)}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,155 @@
|
||||
package importer
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"os"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/darroyo/nasctl/internal/db"
|
||||
"github.com/darroyo/nasctl/internal/system"
|
||||
)
|
||||
|
||||
const (
|
||||
UserMinUID = 1000
|
||||
UserMaxUID = 60000
|
||||
)
|
||||
|
||||
var excludedUsernames = map[string]bool{
|
||||
"nobody": true,
|
||||
"nogroup": true,
|
||||
"sshd": true,
|
||||
"systemd": true,
|
||||
"messagebus": true,
|
||||
"polkitd": true,
|
||||
}
|
||||
|
||||
func ImportSystemUsers(ctx context.Context, adminUsername string) ([]db.User, error) {
|
||||
passwdMap, err := readPasswd()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
groupMap, err := readGroups()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
smbUsers, err := listSMBUsers(ctx)
|
||||
if err != nil {
|
||||
smbUsers = map[string]bool{}
|
||||
}
|
||||
|
||||
var users []db.User
|
||||
for username, uid := range passwdMap {
|
||||
if uid < UserMinUID || uid > UserMaxUID {
|
||||
continue
|
||||
}
|
||||
if excludedUsernames[username] {
|
||||
continue
|
||||
}
|
||||
if username == adminUsername {
|
||||
continue
|
||||
}
|
||||
users = append(users, db.User{
|
||||
Username: username,
|
||||
Groups: groupMap[username],
|
||||
SMBEnabled: smbUsers[username],
|
||||
Disabled: false,
|
||||
})
|
||||
}
|
||||
|
||||
sort.Slice(users, func(i, j int) bool {
|
||||
return users[i].Username < users[j].Username
|
||||
})
|
||||
|
||||
return users, nil
|
||||
}
|
||||
|
||||
func readPasswd() (map[string]int, error) {
|
||||
f, err := os.Open("/etc/passwd")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
result := make(map[string]int)
|
||||
scanner := bufio.NewScanner(f)
|
||||
for scanner.Scan() {
|
||||
line := strings.TrimSpace(scanner.Text())
|
||||
if line == "" || strings.HasPrefix(line, "#") {
|
||||
continue
|
||||
}
|
||||
parts := strings.Split(line, ":")
|
||||
if len(parts) < 3 {
|
||||
continue
|
||||
}
|
||||
username := parts[0]
|
||||
uid, err := strconv.Atoi(parts[2])
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
result[username] = uid
|
||||
}
|
||||
if err := scanner.Err(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func readGroups() (map[string][]string, error) {
|
||||
f, err := os.Open("/etc/group")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
result := make(map[string][]string)
|
||||
scanner := bufio.NewScanner(f)
|
||||
for scanner.Scan() {
|
||||
line := strings.TrimSpace(scanner.Text())
|
||||
if line == "" || strings.HasPrefix(line, "#") {
|
||||
continue
|
||||
}
|
||||
parts := strings.Split(line, ":")
|
||||
if len(parts) < 4 {
|
||||
continue
|
||||
}
|
||||
membersStr := strings.TrimSpace(parts[3])
|
||||
if membersStr == "" {
|
||||
continue
|
||||
}
|
||||
for _, member := range strings.Split(membersStr, ",") {
|
||||
member = strings.TrimSpace(member)
|
||||
if member != "" {
|
||||
result[member] = append(result[member], parts[0])
|
||||
}
|
||||
}
|
||||
}
|
||||
if err := scanner.Err(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func listSMBUsers(ctx context.Context) (map[string]bool, error) {
|
||||
stdout, _, err := system.Run(ctx, "pdbedit", "-L")
|
||||
if err != nil {
|
||||
return map[string]bool{}, nil
|
||||
}
|
||||
result := make(map[string]bool)
|
||||
for _, line := range strings.Split(stdout, "\n") {
|
||||
line = strings.TrimSpace(line)
|
||||
if line == "" {
|
||||
continue
|
||||
}
|
||||
parts := strings.SplitN(line, ":", 2)
|
||||
if len(parts) < 1 {
|
||||
continue
|
||||
}
|
||||
result[parts[0]] = true
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
Reference in New Issue
Block a user