86 lines
4.1 KiB
Python
86 lines
4.1 KiB
Python
#!/usr/bin/env python
|
|
import requests, platform, subprocess, config, logging, simplejson as json, argparse, base64
|
|
from subprocess import call
|
|
|
|
# You must initialize logging, otherwise you'll not see debug output.
|
|
logging.basicConfig(level=logging.INFO,format='%(asctime)s - [%(levelname)s] %(message)s', datefmt='%Y-%m-%d %H:%M:%S')
|
|
#logging.getLogger().setLevel(logging.DEBUG)
|
|
#requests_log = logging.getLogger("requests.packages.urllib3")
|
|
#requests_log.setLevel(logging.DEBUG)
|
|
#requests_log.propagate = True
|
|
|
|
def request(resource, method='GET', data=None):
|
|
if data is None:
|
|
data = ''
|
|
url = 'https://127.0.0.1/api/v1.0/{}'.format(resource)
|
|
logging.debug('Request URL: {}'.format(url))
|
|
logging.debug('Request Data: {}'.format(data))
|
|
logging.debug('CA Certificate Path: {}'.format(config.CA_CERT_PATH))
|
|
r = requests.request(
|
|
method,
|
|
url,
|
|
data=json.dumps(data),
|
|
headers={'Content-Type': "application/json"},
|
|
auth=('root', '{}'.format(config.FREENAS_ROOT_PASSWORD)),
|
|
verify=config.CA_CERT_PATH
|
|
)
|
|
logging.debug('Request Status Code: {}'.format(r.status_code))
|
|
if r.ok:
|
|
try:
|
|
logging.debug('Request Returned JSON: {}'.format(r.json()))
|
|
return {'ok': r.ok, 'status_code': r.status_code, 'response': r.json()}
|
|
except:
|
|
logging.debug('Request Returned Text: {}'.format(r.text))
|
|
return {'ok': r.ok, 'status_code': r.status_code, 'response': r.text}
|
|
raise ValueError(r)
|
|
|
|
|
|
#if __name__ == "__main__":
|
|
# parser = argparse.ArgumentParser(description='Unlock FreeNAS Pools')
|
|
# group = parser.add_mutually_exclusive_group()
|
|
# group.add_argument('-s', '--server', action='store_true', help='server (Usually runs on another system where passwords are stored)')
|
|
# group.add_argument('-c', '--client', action='store_true', help='client (Usually runs on the FreeNAS server)')
|
|
# parser.add_argument('-ip', '--host', type=str, help='Hostname/IP of the host running the unlock script (Required for client)')
|
|
# parser.add_argument('-f', '--filePath', type=str, help='Absolute path to the script on the host (Required for client)')
|
|
# args = parser.parse_args()
|
|
# if args.client and (args.host is None or args.filePath is None):
|
|
# parser.error("--client requires --host and --filePath.")
|
|
|
|
|
|
|
|
# Create a small ramdrive to store our recovery keys temporarily
|
|
rc = call("mkdir /mnt/ramfs", shell=True)
|
|
rc = call("mdmfs -s 1m md /mnt/ramfs", shell=True)
|
|
|
|
# Send our unlock/mount script to the pi and execute it on the pi using ssh
|
|
rc = call("ssh {}@{} 'mkdir /mnt/FreeNASRecoveryKeys; echo -n {} | cryptsetup luksOpen {} FreeNASRecoveryKeys -d - && mount /dev/mapper/FreeNASRecoveryKeys /mnt/FreeNASRecoveryKeys'".format(config.KEY_HOST_USER, config.KEY_HOST, config.LUKS_PASSWORD, config.LUKS_VOLUME), shell=True)
|
|
|
|
# Now we can copy the keys to the ramfs
|
|
for poolName in config.POOL_NAMES:
|
|
rc= call("scp {}@{}:/mnt/FreeNASRecoveryKeys/{}.recoveryKey /mnt/ramfs".format(config.KEY_HOST_USER, config.KEY_HOST, poolName), shell=True)
|
|
|
|
# We can close the luks volume now
|
|
rc = call("ssh {}@{} 'umount /mnt/FreeNASRecoveryKeys; cryptsetup luksClose FreeNASRecoveryKeys'".format(config.KEY_HOST_USER, config.KEY_HOST), shell=True)
|
|
|
|
#Loop through the pools and only unlock the locked ones
|
|
POOLS = request('storage/volume/', 'GET')
|
|
for pool in POOLS['response']:
|
|
if pool['is_decrypted'] == False:
|
|
recovery_key = open('/mnt/ramfs/{}.recoveryKey'.format(pool['name']),'rb')
|
|
recovery_key_binary = recovery_key.read()
|
|
recovery_key_string = (base64.b64encode(recovery_key_binary)).decode('ascii')
|
|
response = request('storage/volume/{}/unlock/'.format(pool['name']), 'POST', {'recovery_key': '{}'.format(recovery_key_string)})
|
|
if response['ok']:
|
|
logging.info('Pool {} was unlocked successfully'.format(pool['name']))
|
|
else:
|
|
logging.error('Pool {} was NOT unlocked successfully'.format(pool['name']))
|
|
else:
|
|
logging.debug('Pool {} is already unlocked'.format(pool['name']))
|
|
|
|
# unmount the ramfs and destory the keys
|
|
rc = call("umount /mnt/ramfs", shell=True)
|
|
|
|
|
|
|
|
|