1#@!#!123s

: / usr / lib / Acronis / BackupAndRecovery /
Filename : create_hosting_panel_client.py
back
#!/usr/sbin/acropsh
from argparse import ArgumentParser
import subprocess
import base64
import json
import uuid
import sys
import os

import xml.etree.ElementTree as ET

try:
    from urllib.parse import urlencode
    from urllib.request import urlopen, Request
    from urllib.error import HTTPError
except ImportError:
    from urllib import urlencode
    from urllib2 import urlopen, Request, HTTPError


class ClientCreator:
    def __init__(self, cred1, cred2, totp_code, bearer_token, ve_ids):
        self.cred1 = cred1
        self.cred2 = cred2
        self.totp_code = totp_code
        self.bearer_token = bearer_token
        self.group_id = ''
        self.tenant_id = ''
        self.ve_ids = ve_ids
        self.headers = {}
        self.dc_url = ''
        self.mc_url = ''

    def run(self):
        print('\nConnecting to the Cyber Protect service...')
        try:
            self.identify_url_and_group()
        except Exception as e:
            print("Failed to identify agent registration details, please confirm the agent is registered and try again")
            sys.exit()
        if not self.bearer_token:
            self.dc_login()
            print('Successfully authenticated with the Cyber Protection service.')
        else:
            self.headers = {'Authorization': 'Bearer {}'.format(self.bearer_token),
                'Content-Type': 'application/json'}
        self.group_to_tenant()
        self.id_vz_ve_to_process()
        self.process_api_clients()

    def identify_url_and_group(self):
        parts = subprocess.check_output(['aakore', 'info']).decode('utf-8').strip().split('cloud server: ')[1].split(' ')
        self.dc_url = parts[0]
        self.mc_url = '{}/api/2/'.format(self.dc_url)
        self.group_id = parts[-1]

    def dc_login(self):
        is_client_auth = False
        try:
            uuid.UUID(str(self.cred1))
            is_client_auth = True
        except:
            pass

        try:
            if not is_client_auth:
                payload = {'grant_type': 'password', 'username': self.cred1, 'password': self.cred2}
                if self.totp_code:
                    payload['totp_code'] = self.totp_code
                login_response = urlopen(Request('{}idp/token'.format(self.mc_url),
                                                data=urlencode(payload).encode('utf-8')))
            else:
                payload = {'grant_type': 'client_credentials'}
                req = Request('{}idp/token'.format(self.mc_url), data=urlencode(payload).encode('utf-8'))
                req.add_header("Authorization", "Basic {}".format(base64.b64encode('{}:{}'.format(self.cred1, self.cred2).encode('utf-8')).decode('utf-8')))
                login_response = urlopen(req)
        except HTTPError as e:
            if 'totp_required' in e.read().decode('utf-8'):
                totp_code = input(
                    '\nThis account is protected with two-factor authentication. Please enter the TOTP code: ')
                login_response = urlopen(Request('{}idp/token'.format(self.mc_url), data=urlencode(
                    {'grant_type': 'password', 'username': self.cred1,
                        'password': self.cred2, 'totp_code': totp_code}
                ).encode('utf-8')))
                if login_response.getcode() != 200:
                    print(
                        "Failed to obtain an access token. Please check your credentials and try again.")
                    sys.exit()
            else:
                raise e
        except Exception as e:
            print("Failed to create an access token: {}".format(e))
            sys.exit()
        if login_response.getcode() != 200:
            if json.loads(login_response.read().decode('utf-8')).get("error") == "totp_required":
                totp_code = input(
                    '\nThis account is protected with two-factor authentication. Please enter the TOTP code: ')
                login_response = urlopen(Request('{}idp/token'.format(self.mc_url), data=urlencode(
                    {'grant_type': 'password', 'username': self.username,
                        'password': self.password, 'totp_code': totp_code}
                ).encode('utf-8')))
                if login_response.getcode() != 200:
                    print(
                        "Failed to obtain an access token. Please check your credentials and try again.")
                    sys.exit()
            else:
                print("Failed to obtain an access token. Please check your credentials and try again.")
                sys.exit()
        self.headers = {'Authorization': 'Bearer {}'.format(json.loads(login_response.read().decode('utf-8')).get('access_token', '')),
                        'Content-Type': 'application/json'}

    def group_to_tenant(self):
        group_req = Request('{}/api/1/groups/{}'.format(self.dc_url, self.group_id), None, self.headers)
        self.tenant_id = json.loads(urlopen(group_req).read().decode('utf-8')).get('uuid')

    def id_vz_ve_to_process(self):
        if self.ve_ids:
            self.ve_ids = self.ve_ids.split(',')
            return
        else:
            self.ve_ids = []
            if os.path.isdir("/vz/root/"):
                try:
                    for line in subprocess.check_output(['prlctl', 'list', '-o', 'uuid', '-H']).decode('utf-8').splitlines():
                        self.ve_ids.append(line.strip().strip('{}'))
                except FileNotFoundError:
                    return

    def process_api_clients(self):
        if self.ve_ids:
            for ve in self.ve_ids:
                try:
                    self.process_api_client(ve)
                except Exception as err:
                    print("Failed to create client for VE {}: {}".format(ve, err))

        else:
            try:
                self.process_api_client()
            except Exception as err:
                print("Failed to create an agent client or save it to file. {}".format(err))

    def process_api_client(self, ve_id=None):
        plugin_srv_path = self.get_secret_file_path(ve_id)
        if not plugin_srv_path:
            print('Unable to detect a hosting control panel. Skipping...')
            return
        client_path = os.path.join(plugin_srv_path, 'client_secret.json')
        res_id = ve_id if ve_id else self.get_res_id_from_agent_config()
        client_id_from_existing_sw_pol = self.client_id_from_existing_sw_policy(res_id)
        client_data = self.get_client_creds(client_path, ve_id)
        if client_data:
            client_id = client_data.get('client_id')
            if client_id:
                if client_id_from_existing_sw_pol and client_id == client_id_from_existing_sw_pol:
                    if self.client_exists(client_id_from_existing_sw_pol):
                        if self.client_is_authorizable(client_data):
                            return
                        else:
                            self.recreate_and_save(client_id, client_path, ve_id)
                            return
                else:
                    if self.client_exists(client_id) and self.is_hosting_panel_agent_type(client_id):
                        self.delete_client_from_cloud(client_id)
        if client_id_from_existing_sw_pol and self.client_exists(client_id_from_existing_sw_pol):
            self.recreate_and_save(client_id_from_existing_sw_pol, client_path, ve_id)
            return
        self.create_client_and_save(client_path, ve_id, client_id_from_existing_sw_pol)

    def get_client_creds(self, client_path, ve_id=None):
        if not ve_id:
            try:
                with open(client_path) as client_file:
                    return json.load(client_file)
            except:
                return {}
        else:
            try:
                return json.loads(subprocess.check_output(['prlctl', 'exec', ve_id, 'cat', client_path, '2>/dev/null']).decode('utf-8').strip())
            except subprocess.CalledProcessError:
                return {}

    def client_exists(self, client_id):
        client_request = Request('{}/api/2/clients/{}'.format(self.dc_url, client_id), None, self.headers)
        try:
            return urlopen(client_request).getcode() == 200
        except HTTPError:
            return False

    def client_is_authorizable(self, client_data):
        payload = {'grant_type': 'client_credentials'}
        req = Request('{}idp/token'.format(self.mc_url), data=urlencode(payload).encode('utf-8'))
        req.add_header("Authorization", "Basic {}".format(base64.b64encode('{}:{}'.format(client_data.get('client_id'), client_data.get('client_secret')).encode('utf-8')).decode('utf-8')))
        try:
            return urlopen(req).getcode() == 200
        except HTTPError:
            return False

    def create_client_and_save(self, path, ve_id=None, client_id=None):
        client_data = self.create_client(ve_id, client_id)
        try:
            self.save_client(client_data, path, ve_id)
        except Exception as e:
            self.delete_client_from_cloud(client_data['client_id'])
            raise e

    def recreate_and_save(self, client_id, path, ve_id=None):
        self.delete_client_from_cloud(client_id)
        self.create_client_and_save(path, ve_id, client_id)

    def check_file_exists(self, path, ve_id=None):
        if not ve_id:
            return os.path.exists(path)
        try:
            subprocess.check_output(['prlctl', 'exec', ve_id, 'ls', path])
            return True
        except subprocess.CalledProcessError:
            return False

    def get_res_id_from_agent_config(self):
        tree = ET.parse('/etc/Acronis/BackupAndRecovery.config')
        root = tree.getroot()
        return root.findall(".//value[@name='InstanceID']")[0].text.replace('"','')

    def compile_client_name(self, ve_id=None):
        if not ve_id:
            return "Instance ID: {}".format(self.get_res_id_from_agent_config())
        else:
            return "Virtuozzo Instance ID: {}".format(ve_id.upper())

    def is_hosting_panel_agent_type(self, client_id):
        client_request = Request('{}/api/2/clients/{}'.format(self.dc_url, client_id), None, self.headers)
        client_response = urlopen(client_request)
        parsed_response = json.loads(client_response.read().decode('utf-8'))
        return parsed_response.get('data', {}).get('agent_type', '') == 'hosting_panel'

    def client_id_from_existing_sw_policy(self, ve_id):
        if not ve_id:
            return None
        app_request = Request(
            '{}/api/policy_management/v4/applications?context_id={}&policy_type=policy.backup.machine'.format(self.dc_url, ve_id),
            None,
            self.headers
        )
        app_response = urlopen(app_request)
        parsed_app_response = json.loads(app_response.read().decode('utf-8'))
        for comp_app in parsed_app_response.get('items', []):
            for app in comp_app:
                if 'policy.backup.' in app.get('policy', {}).get('type', ''):
                    pol_request = Request(
                        '{}/api/policy_management/v4/policies/{}'.format(self.dc_url, app.get('policy', {}).get('id')),
                        None,
                        self.headers
                    )
                    pol_response = urlopen(pol_request)
                    parsed_pol_response = json.loads(pol_response.read().decode('utf-8'))
                    policy = parsed_pol_response.get('policy', [])[0]
                    if 'client_id' in policy:
                        return policy['client_id']
        return None

    def create_client(self, ve_id=None, client_id=None):
        creation_request_body = {
            "type": "agent",
            "tenant_id": self.tenant_id,
            "data": {
                # enterprise/rest_api/mms/webcp.cpp relies on this field format
                # `Instance ID: {}` or `Virtuozzo Instance ID: {}`
                "client_name": self.compile_client_name(ve_id),
                "agent_type": "hosting_panel"
            },
            "token_endpoint_auth_method": "client_secret_basic"
        }
        if client_id:
            creation_request_body['client_id'] = client_id
        creation_request = Request(
            '{}/bc/api/account_server/v2/clients'.format(self.dc_url),
            json.dumps(creation_request_body).encode('utf-8'),
            self.headers
        )
        creation_response = urlopen(creation_request)
        if creation_response.getcode() == 201:
            parsed_response = json.loads(creation_response.read().decode('utf-8'))
            return {key:parsed_response[key] for key in ['client_id', 'client_secret']}
        else:
            raise Exception("Internal error occurred while creating an agent client: {}".format(
                creation_response.getcode()))

    def delete_client_from_cloud(self, client_id):
        client_deletion_request = Request('{}/api/2/clients/{}'.format(self.dc_url, client_id), None, self.headers)
        client_deletion_request.get_method = lambda: 'DELETE'
        client_deletion_response = urlopen(client_deletion_request)
        if client_deletion_response.getcode() != 204:
            print("Failed to delete API client {} from the Cyber Protection service.".format(client_id))

    def get_secret_file_path(self, ve):
        paths = [
            '/usr/local/cpanel/base/3rdparty/acronisbackup/srv',
            '/usr/local/directadmin/plugins/acronisbackup/srv',
            '/usr/local/psa/var/modules/acronis-backup/srv'
        ]
        if not ve:
            for path in paths:
                if os.path.isdir(path):
                    return path
        else:
            for path in paths:
                try:
                    subprocess.check_output(['prlctl', 'exec', ve, 'ls', path, '>/dev/null', '2>&1'])
                    return path
                except subprocess.CalledProcessError:
                    pass
        return None

    def save_client(self, client_data, path, ve_id):
        client_data['url'] = self.dc_url
        client_secret_file_content = json.dumps(client_data, sort_keys=True, separators=(',', ':'))
        if not ve_id:
            try:
                with open(path, 'w') as f:
                    f.write(client_secret_file_content)
                os.chmod(path, 0o660)
            except Exception as e:
                raise Exception(
                    "Failed to save credentials to file {}".format(path))
        else:
            try:
                subprocess.check_output(['prlctl', 'exec', ve_id, 'echo', "'{}'".format(client_secret_file_content), '>', path])
            except Exception as e:
                raise Exception(
                    "Failed to save credentials for VE {}".format(ve_id))

        if self.check_file_exists(path, ve_id):
            print("Agent client was successfully created{}".format(' for ' + ve_id if ve_id else '.'))


def main(args):
    cred1 = ''
    cred2 = os.environ.get('ACRONIS_HOSTING_SECRET', '')
    bearer_token = os.environ.get('ACRONIS_HOSTING_BEARER_TOKEN', '')
    if args.username:
        cred1 = args.username
        if not cred2 and args.password_file:
            with open(args.password_file) as f:
                cred2 = f.readline().strip()

    if args.client_id:
        cred1 = args.client_id
        if not cred2 and args.secret_file:
            with open(args.secret_file) as f:
                cred2 = f.readline().strip()

    if not cred1 and not cred2 and not bearer_token:
        print('Authentication with the Cyber Protection service is required. \
              Please use either --username and --password-file or --client-id and --secret-file.')
        sys.exit()

    cl_creator = ClientCreator(cred1, cred2, args.totp_code, bearer_token, args.ve_id)
    cl_creator.run()
    print('Done! Good bye.')


def parse_arguments():
    parser = ArgumentParser(
        description='This script generates unique API Clients necessary to ensure the connectivity of hosting control panel integrations with Acronis Cyber Protect Cloud. Make sure to run this script on the host where the protection agent is installed. This applies to both agent-based and agentless deployments.')
    parser.add_argument('-u', '--username', help='Account name (login) used during the protection agent installation and registration process.')
    parser.add_argument('-p', '--password-file',
                        help='Path to the file with the password.')
    parser.add_argument('-t', '--totp-code', help='2FA (two-factor authentication) code to complete login.')
    parser.add_argument('-i', '--client-id', help='Client ID used during the protection agent installation and registration process.')
    parser.add_argument('-s', '--secret-file', help='Path to the file with the Client Secret.')
    parser.add_argument('-c', '--ve-id',
                        help='Comma-separated list of virtual environment (container, virtual machine) IDs. If not defined, all virtual environments will be processed.')

    return parser.parse_args()


if __name__ == '__main__':
    main(parse_arguments())