colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

sftpgo: replace deprecated "crypt" with "passlib"

Browse Source
This commit is contained in:
Colin
2024-06-01 13:01:19 +00:00
parent 07194d062a
commit d8d11de9bc
3 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
TODO.md
View File

@@ -27,7 +27,6 @@
- `dmesg | grep 'hid_bpf: error while preloading HID BPF dispatcher: -22'` - `dmesg | grep 'hid_bpf: error while preloading HID BPF dispatcher: -22'`
## REFACTORING: ## REFACTORING:
- REMOVE DEPRECATED `crypt` from sftpgo_auth_hook
- add import checks to my Python nix-shell scripts - add import checks to my Python nix-shell scripts
- consolidate ~/dev and ~/ref - consolidate ~/dev and ~/ref
- ~/dev becomes a link to ~/ref/cat/mine - ~/dev becomes a link to ~/ref/cat/mine

1
hosts/by-name/servo/services/export/sftpgo/default.nix
View File

@@ -12,6 +12,7 @@ let
external_auth_hook = pkgs.static-nix-shell.mkPython3Bin { external_auth_hook = pkgs.static-nix-shell.mkPython3Bin {
pname = "external_auth_hook"; pname = "external_auth_hook";
srcRoot = ./.; srcRoot = ./.;
pyPkgs = [ "passlib" ];
}; };
# Client initiates a FTP "control connection" on port 21. # Client initiates a FTP "control connection" on port 21.
# - this handles the client -> server commands, and the server -> client status, but not the actual data # - this handles the client -> server commands, and the server -> client status, but not the actual data

10
hosts/by-name/servo/services/export/sftpgo/external_auth_hook
View File

@@ -1,5 +1,5 @@
#!/usr/bin/env nix-shell #!/usr/bin/env nix-shell
#!nix-shell -i python3 -p "python3.withPackages (ps: [ ])" #!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.passlib ])"
# vim: set filetype=python : # vim: set filetype=python :
# #
# available environment variables: # available environment variables:
@@ -37,9 +37,9 @@
# - it seems (empirically) that a user can't cd above their home directory. # - it seems (empirically) that a user can't cd above their home directory.
# though i don't have a reference for that in the docs. # though i don't have a reference for that in the docs.
import crypt
import json import json
import os import os
import passlib.hosts
from hmac import compare_digest from hmac import compare_digest
@@ -112,10 +112,8 @@ def isWireguard(ip: str) -> bool:
def isTrustedCred(password: str) -> bool: def isTrustedCred(password: str) -> bool:
for cred in TRUSTED_CREDS: for cred in TRUSTED_CREDS:
_, method, salt, hash_ = cred.split("$") if passlib.hosts.linux_context.verify(password, cred):
# assert method == "6", f"unrecognized crypt entry: {cred}" return True
if crypt.crypt(password, f"${method}${salt}") == cred:
return True
return False return False