public boolean configureUserAccess(SftpClient sftp,
String serverId,
String system,
String username,
SshPublicKey pk,
String authorizationFile,
int mode) throws RemoteIdentificationException {
Vector keys = new Vector();
keys.add(pk);
return configureUserAccess(sftp, serverId, system, username, keys,
authorizationFile, mode);
}
|
public boolean configureUserAccess(SftpClient sftp,
String serverId,
String system,
String username,
List keys,
String authorizationFile,
int mode) throws RemoteIdentificationException {
try {
if (sftp.isClosed()) {
throw new RemoteIdentificationException(
"SFTP connection must be open");
}
if (authorizationFile == null) {
throw new RemoteIdentificationException(
"authorization file cannot be null");
}
if ((mode != ADD_AUTHORIZEDKEY) && (mode != REMOVE_AUTHORIZEDKEY)) {
throw new RemoteIdentificationException(
"Invalid configuration mode specifed in call to configureUserAccess");
}
AuthorizedKeys authorizedKeys;
authorizationFile.replace('\\", '/");
final String directory = ((authorizationFile.lastIndexOf("/") > 0)
? authorizationFile.substring(0,
authorizationFile.lastIndexOf("/") + 1) : "");
try {
// Remove the old backup - ignore the error
try {
sftp.rm(authorizationFile + ".bak");
} catch (IOException ex) {
}
// Change the current authorization file to the backup
sftp.rename(authorizationFile, authorizationFile + ".bak");
log.info("Opening existing authorized keys file from " +
authorizationFile + ".bak");
ByteArrayOutputStream out = new ByteArrayOutputStream();
sftp.get(authorizationFile + ".bak", out);
byte[] backup = out.toByteArray();
out.close();
// Obtain the current authoized keys settings
log.info("Parsing authorized keys file");
authorizedKeys = AuthorizedKeys.parse(backup, serverId, system,
new AuthorizedKeysFileLoader() {
public byte[] loadFile(String filename)
throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
sftp.get(directory + filename, out);
out.close();
return out.toByteArray();
}
});
} catch (IOException ioe) {
// Could not open so create a new file
authorizedKeys = new AuthorizedKeys();
} catch (RemoteIdentificationException rie) {
throw new RemoteIdentificationException(
"Open3SP cannot identify the remote host.\n" +
"Please email support@open3sp.org with specifying 'remote identification' in the subject and supplying the server type and the follwing data '" +
serverId + "'");
}
log.info("Updating authorized keys file");
// Check the existing keys and add any that are not present
SshPublicKey pk;
for (Iterator x = keys.iterator(); x.hasNext();) {
pk = (SshPublicKey) x.next();
if (!authorizedKeys.containsKey(pk) &&
(mode == ADD_AUTHORIZEDKEY)) {
authorizedKeys.addKey(username, pk);
} else if (authorizedKeys.containsKey(pk) &&
(mode == REMOVE_AUTHORIZEDKEY)) {
authorizedKeys.removeKey(pk);
}
}
// Verfiy that the directory exists?
log.info("Verifying directory " + directory);
int umask = sftp.umask(0022);
sftp.mkdirs(directory);
// Output the new file
log.info("Writing new authorized keys file to " +
authorizationFile);
ByteArrayOutputStream out = new ByteArrayOutputStream();
// Output the authorization file to a ByteArrayOutputStream
out.write(AuthorizedKeys.create(authorizedKeys, serverId, system,
new AuthorizedKeysFileSaver() {
public void saveFile(String filename, byte[] filedata)
throws IOException {
//SftpFile file = null;
ByteArrayInputStream in = null;
try {
in = new ByteArrayInputStream(filedata);
sftp.put(in, directory + filename);
} catch (IOException ex) {
log.info("Error writing public key file to server" +
filename, ex);
} finally {
if (in != null) {
in.close();
}
}
}
}));
out.close();
// Copy the new authorisation file to the server
ByteArrayInputStream in = new ByteArrayInputStream(out.toByteArray());
sftp.umask(0133);
sftp.put(in, authorizationFile);
sftp.umask(umask);
return true;
} catch (IOException ioe) {
throw new RemoteIdentificationException(ioe.getMessage());
} catch (RemoteIdentificationException rie) {
throw new RemoteIdentificationException(
"SSHTools cannot identify the remote host.\n" +
"Please email support@sshtools.com specifying 'remote identification' in the subject, supplying the server type and the following data: '" +
serverId + "'");
}
}
|