macadmin 0.0.4

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: a1103e52f907edbf5e1f175278e7eaecb7f5be21
+  data.tar.gz: db158590675a6499a351b7ca06c77d0d60078ff8
+SHA512:
+  metadata.gz: 898ced3234ca7f09c0271bab0ebcce352c02a01c015349aabcf815a5463b82833e4dd7a94c1e5475b2a65f3f06fc1d937b02a96463df4eae30e46e9a144d7b14
+  data.tar.gz: c3e4d8b825d5ec08a684edf1a59c5f40a107b8cb3bcc8bf5567729249bc436e82c064e7c16704de8dd6d84cadcb7caf835e043b43ad35f7ab0ed285ca22bbbf5

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+*.bundle
+*.config
+*.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/.travis.yml

@@ -0,0 +1,4 @@
+language: ruby
+rvm:
+  - 1.8.7
+  - 2.0.0

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in macadmin.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2013 Brian Warsing
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,163 @@
+# MacAdmin
+
+Gem to assist in performing common systems administration tasks in OS X
+
+## Version: 0.0.4
+
+## About
+
+MacAdmin endeavors to provide an OO programming interface for constituent OS X system resources. It's comprised of classes with the ability to parse Apple Property Lists (CFPropertyList) and manipulate them as native Ruby objects. The classes work directly with the Property Lists used to abstract OS X system resources -- users, groups, computers, computergroups, etc. -- bypassing the common utilities and APIs normally reserved for this kind of work.
+
+This approach has trade-offs, but it does result in a very powerful and simple model for managing these resources (See Notes).
+
+#### Notes:
+
+Before forking/cloning/using/testing/etc MacAdmin, please read the license (LICENSE.txt).
+
+One important trade-off worth mentioning when using this gem is that you must have root priviledge in order to access (read) any resources in the DSLocal domains or similarily protected directories and files. This is different from using utils like `dscl`, but not unlike using `defaults`. Naturally, as with any of these methods, you must also be root in order to make any changes. The code examples below will require root access when performing create operations.
+
+Another important condition to mention is that it will often be necessary to restart OS X's directory service in order to see the changes you've made to any of the affected plists. This can be bothersome and susceptible to race conditions, but in general, it's a manageable issue.
+
+## Requirements
+
+- Mac OS X 10.5 and up
+- Xcode Command Line Tools
+
+## Installation
+
+### Simple:
+
+RubyGems should install any dependencies:
+
+    $ sudo gem install macadmin
+
+### Manual:
+
+Install the bundler gem:
+
+    $ sudo gem install bundler
+
+Clone this repo:
+
+    $ cd ~/Downloads
+    $ git clone http://github.com/dayglojesus/macadmin.git
+
+Install the gem dependencies:
+
+    $ cd macadmin
+    $ sudo bundle install
+
+Run the tests:
+
+    $ rake
+
+Install the gem:
+
+    $ sudo rake install
+
+Test the installation:
+
+##### Note the path parameter to #create -- use this for testing resource creation in arbitrary directories. Also works for #destroy.
+
+    $ cd ~/Downloads
+    $ irb -r 'macadmin'
+    >> foobar = User.new 'foobar'
+    => {"passwd"=>["********"], "gid"=>["20"], "uid"=>["501"], "shell"=>["/bin/bash"], "name"=>["foobar"], "realname"=>["foobar"], "generateduid"=>["4871DD7C-5C55-47DB-8A7B-B38CBD6DA5A9"], "comment"=>[""], "home"=>["/Users/foobar"]}
+    >> foobar.exists?
+    => false
+    >> foobar.create "./foobar.plist"
+    >> foobar.destroy "./foobar.plist"
+    >> exit
+
+## Usage
+
+Load the gems:
+
+    require 'rubygems'
+    require 'macadmin'
+
+Create a new node:
+
+    # Here's something cool: 
+    # DSLocalNode will automatically add this custom node to OpenDirectory sandbox when running on 10.8 and up
+    my_custom_node = DSLocalNode.new 'MCX'
+    my_custom_node.create_and_activate
+
+Create a computer record on that node:
+
+    computer = Computer.new :name => `hostname -s`.chomp, :node => 'MCX'
+    computer.create
+
+Create a computer group, add the computer record as a member, and apply some policy (on that node):
+
+    # Here's a bnuch of policy written as XML, but the mcximport method can also take a file path parameter and load it that way
+    raw_xml_policy = <<-RAW_XML_CONTENT
+    <?xml version="1.0" encoding="UTF-8"?>
+    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+    <plist version="1.0">
+    <dict>
+    <key>com.apple.SoftwareUpdate</key>
+    <dict>
+    	<key>CatalogURL</key>
+    	<dict>
+    		<key>state</key>
+    		<string>always</string>
+    		<key>value</key>
+    		<string>http://foo.bar.com/reposado/html/content/catalogs/index.sucatalog</string>
+    	</dict>
+    </dict>
+    <key>com.apple.screensaver</key>
+    <dict>
+    	<key>askForPassword</key>
+    	<dict>
+    		<key>state</key>
+    		<string>once</string>
+    		<key>value</key>
+    		<integer>1</integer>
+    	</dict>
+    </dict>
+    </dict>
+    </plist>
+    RAW_XML_CONTENT
+    
+    computer_group = ComputerGroup.new :name => 'mcx', :realname => 'MCX', :node => 'MCX'
+    computer_group.add_user `hostname -s`.chomp
+    computer_group.mcximport raw_xml_policy
+    computer_group.create
+
+Create an administrator for your new node:
+
+    # Generate a platform appropriate password from a plaintext string
+    password = Password.apropos "secret_passphrase"
+    administrator = User.new :name => 'mcxadmin', :password => password, :gid => 80, :node => 'MCX'
+    administrator.create
+
+Restart the directory services to seal the deal:
+
+    restart_directoryservice
+
+Explore a bit...
+
+    require 'pp'
+    
+    # Show the User object
+    admin = User.new :name => 'mcxadmin', :node => 'MCX'
+    pp admin.record if admin.exists?
+    
+    # Show the MCX policy attached to the ComputerGroup object
+    comp_grp = ComputerGroup.new :name => 'mcx', :node => 'MCX'
+    puts "Does this local computer group have MCX policy?"
+    puts comp_grp.has_mcx? ? "Sweet!" : "Bummer..."
+    puts comp_grp.mcxexport
+
+Tear it down...
+
+    # This will take down the entire node we just created and populated: user, computers, computer groups, etc.
+    mcx_node = DSLocalNode.new 'MCX'
+    mcx_node.destroy_and_deactivate
+    
+    restart_directoryservice
+
+## Acknowledgments
+
+This gem would not be possible without [ckuse's CFPropertyList](https://github.com/ckruse/CFPropertyList). Thanks, Christian.

data/Rakefile

@@ -0,0 +1,23 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+require "macadmin/common"
+
+# Only build the extension for Mountian Lion or better
+if MacAdmin::Common::MAC_OS_X_PRODUCT_VERSION > 10.7
+  
+  require "rake/extensiontask"
+  
+  Rake::ExtensionTask.new "crypto" do |ext|
+    ext.lib_dir = 'lib/macadmin/password'
+    ext.name    = 'crypto'
+    ext.ext_dir = 'ext/macadmin/password'
+  end
+  
+  Rake::Task[:spec].prerequisites << :compile
+  
+end
+
+RSpec::Core::RakeTask.new
+
+task :default => :spec
+task :test => :spec

data/ext/macadmin/password/crypto.c

@@ -0,0 +1,89 @@
+//
+//  crypto.c
+//  MacAdmin::Password::Crypto
+//  - Ruby C extension built for fast PBKDF2 calculation
+//
+//  Created by Brian Warsing on 2013-10-07.
+//  Copyright (c) 2013 Simon Fraser University. All rights reserved.
+//
+
+#include <stdio.h>
+#include <stdint.h>
+#include <CommonCrypto/CommonCrypto.h>
+#include "ruby.h"
+
+VALUE MacAdmin       = Qnil;
+VALUE Password = Qnil;
+
+// Prototypes
+void Init_crypto();
+static VALUE salted_sha512_pbkdf2_from_string(VALUE self, VALUE input);
+void to_hex( uint8_t *dest, const uint8_t *text, size_t text_size );
+
+// Convert an ASCII char array to hexidecimal representation
+void to_hex( uint8_t *dest, const uint8_t *text, size_t text_size )
+{
+    int i;
+    for(i = 0; i < text_size; i++)
+        sprintf((char*)dest+i*2, "%02x", text[i]);
+}
+
+// Ruby Init
+void Init_crypto() {
+    MacAdmin = rb_define_module("MacAdmin");
+    Password = rb_define_module_under(MacAdmin, "Password");
+    rb_define_singleton_method(Password, "salted_sha512_pbkdf2_from_string", salted_sha512_pbkdf2_from_string, 1);
+}
+
+// salted_sha512_pbkdf2_from_string
+// - single param: Ruby String
+// - returns Ruby Hash with 3 keys
+// http://blog.securemacprogramming.com/2012/07/password-checking-with-commoncrypto/
+static VALUE salted_sha512_pbkdf2_from_string(VALUE self, VALUE input) {
+    
+    VALUE str = StringValue(input);
+    char *password = RSTRING_PTR(str);   // may be null
+    size_t password_size = RSTRING_LEN(str);
+    int salt_len = 32;
+    
+    // Calc how many iterations
+    const u_int32_t interval = arc4random_uniform(100) + 100;
+    int iterations = CCCalibratePBKDF(kCCPBKDF2,
+                                      password_size,
+                                      salt_len,
+                                      kCCPRFHmacAlgSHA512,
+                                      kCCKeySizeMaxRC2,
+                                      interval);
+
+    // Generate a salt
+    int i;
+    uint8_t salt[salt_len];
+    for (i = 0; i < salt_len; i++)
+        salt[i] = (unsigned char)arc4random();
+    
+    // Generate HMAC
+    uint8_t key[kCCKeySizeMaxRC2] = {0};
+    int result = CCKeyDerivationPBKDF(kCCPBKDF2,
+                                      password,
+                                      password_size,
+                                      salt,
+                                      salt_len,
+                                      kCCPRFHmacAlgSHA512,
+                                      iterations,
+                                      key,
+                                      kCCKeySizeMaxRC2);
+    
+    uint8_t *entropy[kCCKeySizeMaxRC2];
+    to_hex(entropy, key, kCCKeySizeMaxRC2);
+    
+    uint8_t *salt_hex[salt_len];
+    to_hex(salt_hex, salt, salt_len);
+    
+    VALUE dict;
+    dict = rb_hash_new();    
+    rb_hash_aset(dict, ID2SYM(rb_intern(("entropy"))),    rb_str_new2((char *)entropy));
+    rb_hash_aset(dict, ID2SYM(rb_intern(("salt"))),       rb_str_new2((char *)salt_hex));
+    rb_hash_aset(dict, ID2SYM(rb_intern(("iterations"))), INT2NUM(iterations));
+    
+    return dict;
+}

data/ext/macadmin/password/extconf.rb

@@ -0,0 +1,3 @@
+require 'mkmf'
+dir_config('macadmin')
+create_makefile('macadmin/password/crypto')

data/lib/macadmin.rb

@@ -0,0 +1,22 @@
+# macadmin gem
+# Sat Aug 11 16:14:56 PDT 2012
+require 'rubygems'
+require 'cgi'
+require 'time'
+require 'delegate'
+require 'fileutils'
+require 'cfpropertylist'
+require 'macadmin/version'
+require 'macadmin/common'
+require 'macadmin/mcx'
+require 'macadmin/password'
+require 'macadmin/shadowhash'
+require 'macadmin/dslocal'
+require 'macadmin/dslocal/user'
+require 'macadmin/dslocal/group'
+require 'macadmin/dslocal/computer'
+require 'macadmin/dslocal/computergroup'
+require 'macadmin/dslocal/dslocalnode'
+
+include MacAdmin
+include MacAdmin::Common

data/lib/macadmin/common.rb

@@ -0,0 +1,80 @@
+module MacAdmin
+  
+  # Common
+  # - module comtaining classes and methods common to macadmin
+  module Common
+    
+    extend self
+    
+    # Mac OS X major version number
+    MAC_OS_X_PRODUCT_VERSION = `/usr/bin/sw_vers`.split("\n")[1].split("\t").last.to_f
+   
+    # Class for creating and checking UUID strings
+    class UUID < String
+    
+      # 897A6343-628F-4964-80F1-C86D0FFA3F91
+      UUID_REGEX = '([A-Z0-9]{8})-([A-Z0-9]{4}-){3}([A-Z0-9]{12})'
+      
+      # Create a new UUID string
+      def initialize
+        uuid = %x{/usr/bin/uuidgen}.chomp
+        super(uuid)
+      end
+      
+      # Class methods
+      class << self
+        
+        # Matches any string containing a UUID
+        # - returns Boolean
+        def match(string, options = nil)
+          string =~ Regexp.new(UUID_REGEX, options) ? $& : false
+        end
+        
+        # Validates the format of a UUID string
+        # - only true is the entire string is a UUID match
+        # - returns Boolean
+        def valid?(uuid, options = nil)
+          strictlyuuid = '^' + UUID_REGEX + '$'
+          uuid =~ Regexp.new(strictlyuuid, options) ? true : false
+        end
+        
+      end
+        
+    end
+    
+    # Get the primary ethernet's MAC address
+    # - returns String
+    def get_primary_mac_address
+      raw = %x{/sbin/ifconfig en0}
+      raw.split("\n").grep(/ether/).first.split.last
+    end
+    
+    # Load a PropertyList file
+    # - convenience method
+    # - single parameter is a path to the ProperyList file
+    # - returns a Hash is if can parse the file
+    # - returns nil if it cannot parse the file 
+    def load_plist(file)
+      return nil unless File.exists? file
+      plist = CFPropertyList::List.new(:file => file)
+      CFPropertyList.native_types(plist.value)
+    end
+    
+    # Restart the local directory service daemon
+    # - single param wait (Integer) measured in seconds
+    # - default wait is 10 seconds
+    def restart_directoryservice(wait=10)
+      if MAC_OS_X_PRODUCT_VERSION > 10.6
+        system('/usr/bin/killall opendirectoryd')
+      else
+        system('/usr/bin/killall DirectoryService')
+      end
+      sleep wait
+    end
+  
+    # Alias for convenience
+    alias :restart_opendirectoryd :restart_directoryservice
+  
+  end
+  
+end