first commit

app/puk/linux.py

@@ -0,0 +1,142 @@
+"""Linux-Konten auf einer gemounteten Partition zuruecksetzen.
+
+Arbeitet direkt auf ``<mnt>/etc/shadow``. Vor jeder Aenderung wird eine
+Sicherungskopie ``shadow.puk.bak`` abgelegt. Passwort-Hashes werden lokal mit
+``crypt`` (SHA-512) erzeugt.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import time
+from dataclasses import dataclass
+
+try:
+    import crypt  # entfernt in Python 3.13
+    _HAVE_CRYPT = True
+except ImportError:  # pragma: no cover
+    _HAVE_CRYPT = False
+
+
+def _hash_password(password: str) -> str:
+    """SHA-512 crypt-Hash erzeugen; Fallback ueber openssl, falls crypt fehlt."""
+    if _HAVE_CRYPT:
+        return crypt.crypt(password, crypt.mksalt(crypt.METHOD_SHA512))
+    res = subprocess.run(
+        ["openssl", "passwd", "-6", "-stdin"],
+        input=password, capture_output=True, text=True, check=True,
+    )
+    return res.stdout.strip()
+
+
+@dataclass
+class LinuxUser:
+    name: str
+    uid: int
+    locked: bool
+    has_password: bool
+    shell: str
+
+    @property
+    def display(self) -> str:
+        flags = []
+        if self.locked:
+            flags.append("gesperrt")
+        if not self.has_password:
+            flags.append("kein PW")
+        tail = f"  ({', '.join(flags)})" if flags else ""
+        return f"{self.name}  uid={self.uid}  {self.shell}{tail}"
+
+
+def _shadow_path(mnt: str) -> str:
+    return os.path.join(mnt, "etc", "shadow")
+
+
+def _passwd_path(mnt: str) -> str:
+    return os.path.join(mnt, "etc", "passwd")
+
+
+def list_users(mnt: str) -> list[LinuxUser]:
+    """Login-faehige Konten aus passwd/shadow lesen."""
+    shells: dict[str, tuple[int, str]] = {}
+    with open(_passwd_path(mnt), encoding="utf-8", errors="replace") as fh:
+        for line in fh:
+            f = line.rstrip("\n").split(":")
+            if len(f) >= 7:
+                shells[f[0]] = (int(f[2] or -1), f[6])
+
+    users: list[LinuxUser] = []
+    with open(_shadow_path(mnt), encoding="utf-8", errors="replace") as fh:
+        for line in fh:
+            f = line.rstrip("\n").split(":")
+            if len(f) < 2:
+                continue
+            name, pw = f[0], f[1]
+            uid, shell = shells.get(name, (-1, ""))
+            # System-/Dienstkonten ausblenden, echte Logins zeigen
+            is_login = (uid == 0) or (uid >= 1000) or shell.endswith(
+                ("/bash", "/sh", "/zsh", "/fish"))
+            if not is_login:
+                continue
+            locked = pw.startswith("!") or pw.startswith("*")
+            has_pw = bool(pw) and not locked and pw not in ("!", "*", "!!")
+            users.append(LinuxUser(name, uid, locked, has_pw, shell))
+    users.sort(key=lambda u: (u.uid != 0, u.uid))
+    return users
+
+
+def _rewrite(mnt: str, username: str, new_field: str) -> None:
+    path = _shadow_path(mnt)
+    shutil.copy2(path, path + ".puk.bak")
+    with open(path, encoding="utf-8", errors="replace") as fh:
+        lines = fh.readlines()
+
+    now_days = int(time.time() // 86400)
+    out = []
+    found = False
+    for line in lines:
+        f = line.rstrip("\n").split(":")
+        if f and f[0] == username:
+            found = True
+            f[1] = new_field
+            # Feld 3 = letzte Aenderung; aktualisieren, Rest auffuellen
+            while len(f) < 9:
+                f.append("")
+            f[2] = str(now_days)
+            out.append(":".join(f) + "\n")
+        else:
+            out.append(line)
+    if not found:
+        raise RuntimeError(f"Benutzer {username} nicht in shadow gefunden")
+
+    tmp = path + ".puk.tmp"
+    with open(tmp, "w", encoding="utf-8") as fh:
+        fh.writelines(out)
+    os.chmod(tmp, 0o640)
+    os.replace(tmp, path)
+
+
+def blank_password(mnt: str, username: str) -> None:
+    """Passwortfeld leeren -> Login ohne Passwort moeglich."""
+    _rewrite(mnt, username, "")
+
+
+def set_password(mnt: str, username: str, password: str) -> None:
+    """Neues SHA-512-Passwort setzen."""
+    _rewrite(mnt, username, _hash_password(password))
+
+
+def unlock(mnt: str, username: str) -> None:
+    """Fuehrendes ! / * entfernen (Konto entsperren) ohne Passwort zu aendern."""
+    path = _shadow_path(mnt)
+    with open(path, encoding="utf-8", errors="replace") as fh:
+        lines = fh.readlines()
+    for line in lines:
+        f = line.rstrip("\n").split(":")
+        if f and f[0] == username:
+            pw = f[1].lstrip("!*")
+            _rewrite(mnt, username, pw)
+            return
+    raise RuntimeError(f"Benutzer {username} nicht gefunden")