def testUserModificationAudit(self): worker = worker_test_lib.MockWorker(token=self.token) token = self.GenerateToken(username="******", reason="reason") maintenance_utils.AddUser( "testuser", password="******", labels=["admin"], token=token) worker.Simulate() maintenance_utils.UpdateUser( "testuser", "xxx", delete_labels=["admin"], token=token) worker.Simulate() maintenance_utils.DeleteUser("testuser", token=token) worker.Simulate() log_entries = [] for log in audit._AllLegacyAuditLogs(token=self.token): log_entries.extend(log) self.assertEqual(len(log_entries), 3) self.assertEqual(log_entries[0].action, "USER_ADD") self.assertEqual(log_entries[0].urn, "aff4:/users/testuser") self.assertEqual(log_entries[0].user, "usermodtest") self.assertEqual(log_entries[1].action, "USER_UPDATE") self.assertEqual(log_entries[1].urn, "aff4:/users/testuser") self.assertEqual(log_entries[1].user, "usermodtest") self.assertEqual(log_entries[2].action, "USER_DELETE") self.assertEqual(log_entries[2].urn, "aff4:/users/testuser") self.assertEqual(log_entries[2].user, "usermodtest")
def FinalizeConfigInit(config, token): """Performs the final steps of config initialization.""" config.Set("Server.initialized", True) print("\nWriting configuration to %s." % config["Config.writeback"]) config.Write() print("Initializing the datastore.") # Reload the config and initialize the GRR database. server_startup.Init() print("\nStep 3: Adding GRR Admin User") try: maintenance_utils.AddUser("admin", labels=["admin"], token=token, password=flags.FLAGS.admin_password) except maintenance_utils.UserError: if flags.FLAGS.noprompt: maintenance_utils.UpdateUser("admin", password=flags.FLAGS.admin_password, add_labels=["admin"], token=token) else: # pytype: disable=wrong-arg-count if ((builtins.input("User 'admin' already exists, do you want to " "reset the password? [yN]: ").upper() or "N") == "Y"): maintenance_utils.UpdateUser("admin", password=True, add_labels=["admin"], token=token) # pytype: enable=wrong-arg-count print("\nStep 4: Repackaging clients with new configuration.") redownload_templates = False repack_templates = False if flags.FLAGS.noprompt: redownload_templates = flags.FLAGS.redownload_templates repack_templates = not flags.FLAGS.norepack_templates else: redownload_templates = RetryBoolQuestion( "Server debs include client templates. Re-download templates?", False) repack_templates = RetryBoolQuestion("Repack client templates?", True) if redownload_templates: InstallTemplatePackage() # Build debug binaries, then build release binaries. if repack_templates: repacking.TemplateRepacker().RepackAllTemplates(upload=True, token=token) print("\nGRR Initialization complete! You can edit the new configuration " "in %s.\n" % config["Config.writeback"]) print("Please restart the service for the new configuration to take " "effect.\n")
def AddUsers(token=None): # Now initialize with our modified config. server_startup.Init() print("\nStep 3: Adding Admin User") try: maintenance_utils.AddUser("admin", labels=["admin"], token=token, password=flags.FLAGS.admin_password) except maintenance_utils.UserError: if flags.FLAGS.noprompt: maintenance_utils.UpdateUser("admin", password=flags.FLAGS.admin_password, add_labels=["admin"], token=token) else: if ((input("User 'admin' already exists, do you want to " "reset the password? [yN]: ").upper() or "N") == "Y"): maintenance_utils.UpdateUser("admin", password=True, add_labels=["admin"], token=token)
def main(argv): """Main.""" del argv # Unused. if flags.FLAGS.subparser_name == "version": version = config_server.VERSION["packageversion"] print("GRR configuration updater {}".format(version)) return token = config_updater_util.GetToken() grr_config.CONFIG.AddContext(contexts.COMMAND_LINE_CONTEXT) grr_config.CONFIG.AddContext(contexts.CONFIG_UPDATER_CONTEXT) if flags.FLAGS.subparser_name == "initialize": config_lib.ParseConfigCommandLine() if flags.FLAGS.noprompt: config_updater_util.InitializeNoPrompt(grr_config.CONFIG, token=token) else: config_updater_util.Initialize(grr_config.CONFIG, token=token) return server_startup.Init() try: print("Using configuration %s" % grr_config.CONFIG) except AttributeError: raise RuntimeError("No valid config specified.") if flags.FLAGS.subparser_name == "generate_keys": try: config_updater_util.GenerateKeys( grr_config.CONFIG, overwrite_keys=flags.FLAGS.overwrite_keys) except RuntimeError as e: # GenerateKeys will raise if keys exist and overwrite_keys is not set. print("ERROR: %s" % e) sys.exit(1) grr_config.CONFIG.Write() elif flags.FLAGS.subparser_name == "repack_clients": upload = not flags.FLAGS.noupload repacking.TemplateRepacker().RepackAllTemplates(upload=upload, token=token) elif flags.FLAGS.subparser_name == "show_user": maintenance_utils.ShowUser(flags.FLAGS.username, token=token) elif flags.FLAGS.subparser_name == "update_user": try: maintenance_utils.UpdateUser(flags.FLAGS.username, flags.FLAGS.password, flags.FLAGS.add_labels, flags.FLAGS.delete_labels, token=token) except maintenance_utils.UserError as e: print(e) elif flags.FLAGS.subparser_name == "delete_user": maintenance_utils.DeleteUser(flags.FLAGS.username, token=token) elif flags.FLAGS.subparser_name == "add_user": labels = [] if not flags.FLAGS.noadmin: labels.append("admin") if flags.FLAGS.labels: labels.extend(flags.FLAGS.labels) try: maintenance_utils.AddUser(flags.FLAGS.username, flags.FLAGS.password, labels, token=token) except maintenance_utils.UserError as e: print(e) elif flags.FLAGS.subparser_name == "upload_python": python_hack_root_urn = grr_config.CONFIG.Get("Config.python_hack_root") content = open(flags.FLAGS.file, "rb").read(1024 * 1024 * 30) aff4_path = flags.FLAGS.dest_path platform = flags.FLAGS.platform if not aff4_path: aff4_path = python_hack_root_urn.Add(platform.lower()).Add( os.path.basename(flags.FLAGS.file)) if not str(aff4_path).startswith(str(python_hack_root_urn)): raise ValueError("AFF4 path must start with %s." % python_hack_root_urn) context = ["Platform:%s" % platform.title(), "Client Context"] maintenance_utils.UploadSignedConfigBlob(content, aff4_path=aff4_path, client_context=context, token=token) elif flags.FLAGS.subparser_name == "upload_exe": content = open(flags.FLAGS.file, "rb").read(1024 * 1024 * 30) context = [ "Platform:%s" % flags.FLAGS.platform.title(), "Client Context" ] if flags.FLAGS.dest_path: dest_path = rdfvalue.RDFURN(flags.FLAGS.dest_path) else: dest_path = grr_config.CONFIG.Get( "Executables.aff4_path", context=context).Add(os.path.basename(flags.FLAGS.file)) # Now upload to the destination. maintenance_utils.UploadSignedConfigBlob(content, aff4_path=dest_path, client_context=context, token=token) print("Uploaded to %s" % dest_path) elif flags.FLAGS.subparser_name == "set_var": config = grr_config.CONFIG print("Setting %s to %s" % (flags.FLAGS.var, flags.FLAGS.val)) if flags.FLAGS.val.startswith("["): # Allow setting of basic lists. flags.FLAGS.val = flags.FLAGS.val[1:-1].split(",") config.Set(flags.FLAGS.var, flags.FLAGS.val) config.Write() elif flags.FLAGS.subparser_name == "upload_raw": if not flags.FLAGS.dest_path: flags.FLAGS.dest_path = aff4.ROOT_URN.Add("config").Add("raw") uploaded = config_updater_util.UploadRaw(flags.FLAGS.file, flags.FLAGS.dest_path, token=token) print("Uploaded to %s" % uploaded) elif flags.FLAGS.subparser_name == "upload_artifact": yaml.load(open(flags.FLAGS.file, "rb")) # Check it will parse. try: artifact.UploadArtifactYamlFile( open(flags.FLAGS.file, "rb").read(), overwrite=flags.FLAGS.overwrite_artifact) except rdf_artifacts.ArtifactDefinitionError as e: print("Error %s. You may need to set --overwrite_artifact." % e) elif flags.FLAGS.subparser_name == "delete_artifacts": artifact_list = flags.FLAGS.artifact if not artifact_list: raise ValueError("No artifact to delete given.") artifact_registry.DeleteArtifactsFromDatastore(artifact_list, token=token) print("Artifacts %s deleted." % artifact_list) elif flags.FLAGS.subparser_name == "download_missing_rekall_profiles": print("Downloading missing Rekall profiles.") s = rekall_profile_server.GRRRekallProfileServer() s.GetMissingProfiles() elif flags.FLAGS.subparser_name == "set_global_notification": notification = aff4_users.GlobalNotification( type=flags.FLAGS.type, header=flags.FLAGS.header, content=flags.FLAGS.content, link=flags.FLAGS.link) if flags.FLAGS.show_from: notification.show_from = rdfvalue.RDFDatetime( ).ParseFromHumanReadable(flags.FLAGS.show_from) if flags.FLAGS.duration: notification.duration = rdfvalue.Duration().ParseFromHumanReadable( flags.FLAGS.duration) print("Setting global notification.") print(notification) with aff4.FACTORY.Create( aff4_users.GlobalNotificationStorage.DEFAULT_PATH, aff4_type=aff4_users.GlobalNotificationStorage, mode="rw", token=token) as storage: storage.AddNotification(notification) elif flags.FLAGS.subparser_name == "rotate_server_key": print(""" You are about to rotate the server key. Note that: - Clients might experience intermittent connection problems after the server keys rotated. - It's not possible to go back to an earlier key. Clients that see a new certificate will remember the cert's serial number and refuse to accept any certificate with a smaller serial number from that point on. """) if builtins.input("Continue? [yN]: ").upper() == "Y": if flags.FLAGS.keylength: keylength = int(flags.FLAGS.keylength) else: keylength = grr_config.CONFIG["Server.rsa_key_length"] maintenance_utils.RotateServerKey(cn=flags.FLAGS.common_name, keylength=keylength)