-
Notifications
You must be signed in to change notification settings - Fork 54
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: mysql管理密码随机化、密码存储、密码安全规则管理、字符串复杂度检测、生成随机密码、根据id查询账号规则
- Loading branch information
1 parent
3241d0f
commit 161ce83
Showing
30 changed files
with
1,632 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,4 +13,5 @@ pubkey.pem | |
| privkey.pem | ||
| infile | ||
| outfile | ||
| .code.yml | ||
| .code.yml | ||
| *.log | ||
File renamed without changes.
File renamed without changes.
2 changes: 2 additions & 0 deletions
2
dbm-services/mysql/db-priv/assests/migrations/000004_init.down.sql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| DROP TABLE IF EXISTS tb_security_rules; | ||
| DROP TABLE IF EXISTS tb_passwords; |
30 changes: 30 additions & 0 deletions
30
dbm-services/mysql/db-priv/assests/migrations/000004_init.up.sql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| SET NAMES utf8; | ||
| CREATE TABLE IF NOT EXISTS `tb_security_rules` ( | ||
| `id` int(11) NOT NULL AUTO_INCREMENT, | ||
| `name` varchar(200) NOT NULL COMMENT '规则名称', | ||
| `rule` json NOT NULL COMMENT '安全规则', | ||
| `creator` varchar(800) NOT NULL COMMENT '创建者', | ||
| `create_time` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间', | ||
| `operator` varchar(800) DEFAULT NULL COMMENT '最后一次变更者', | ||
| `update_time` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '最后一次变更时间', | ||
| PRIMARY KEY (`id`), | ||
| UNIQUE KEY `idx_name` (`name`)) ENGINE=InnoDB DEFAULT CHARSET=utf8; | ||
|
|
||
| CREATE TABLE IF NOT EXISTS `tb_passwords` ( | ||
| `ip` varchar(100) NOT NULL COMMENT '实例ip', | ||
| `port` int unsigned NOT NULL COMMENT '实例端口', | ||
| `password` varchar(800) NOT NULL COMMENT '加密后的密码', | ||
| `username` varchar(800) NOT NULL COMMENT '用户名称', | ||
| `lock_until` timestamp COMMENT '锁定到的时间', | ||
| `operator` varchar(800) DEFAULT NULL COMMENT '最后一次变更者', | ||
| `update_time` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '最后一次变更时间', | ||
| UNIQUE KEY `idx_ip_port` (ip, port, username), | ||
| KEY `idx_lock` (`lock_until`)) ENGINE=InnoDB DEFAULT CHARSET=utf8; | ||
|
|
||
| CREATE TABLE IF NOT EXISTS `tb_randomize_exclude` ( | ||
| `username` varchar(800) NOT NULL COMMENT '用户名称', | ||
| `bk_biz_id` int(11) NOT NULL COMMENT '业务的 cmdb id', | ||
| `operator` varchar(800) DEFAULT NULL COMMENT '最后一次变更者', | ||
| `update_time` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '最后一次变更时间', | ||
| UNIQUE KEY `idx_username_bk_biz_id` (username, bk_biz_id)) ENGINE=InnoDB DEFAULT CHARSET=utf8; | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| package handler | ||
|
|
||
| import ( | ||
| "dbm-services/common/go-pubpkg/errno" | ||
| "dbm-services/mysql/priv-service/service" | ||
| "encoding/json" | ||
| "io/ioutil" | ||
|
|
||
| "github.com/gin-gonic/gin" | ||
| "golang.org/x/exp/slog" | ||
| ) | ||
|
|
||
| // GetPassword 查询用户的密码 | ||
| func (m *PrivService) GetPassword(c *gin.Context) { | ||
| slog.Info("do GetPassword!") | ||
| var input service.GetPasswordPara | ||
| body, err := ioutil.ReadAll(c.Request.Body) | ||
| if err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
| if err = json.Unmarshal(body, &input); err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
| batch, err := input.GetPassword() | ||
| SendResponse(c, err, batch) | ||
| return | ||
|
|
||
| } | ||
|
|
||
| // ModifyPassword 新增或者修改密码 | ||
| func (m *PrivService) ModifyPassword(c *gin.Context) { | ||
| slog.Info("do ModifyMysqlAdminPassword!") | ||
| var input service.ModifyPasswordPara | ||
| body, err := ioutil.ReadAll(c.Request.Body) | ||
| if err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
| if err = json.Unmarshal(body, &input); err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
| err = input.ModifyPassword() | ||
| SendResponse(c, err, nil) | ||
| return | ||
| } | ||
|
|
||
| // ModifyMysqlAdminPassword 新增或者修改mysql实例中管理用户的密码，可用于随机化密码 | ||
| func (m *PrivService) ModifyMysqlAdminPassword(c *gin.Context) { | ||
| slog.Info("do ModifyMysqlAdminPassword!") | ||
| var input service.ModifyAdminUserPasswordPara | ||
|
|
||
| body, err := ioutil.ReadAll(c.Request.Body) | ||
| if err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
|
|
||
| if err = json.Unmarshal(body, &input); err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
| // 随机化定时任务异步返回，避免占用资源 | ||
| if input.Async == true { | ||
| SendResponse(c, nil, nil) | ||
| } | ||
| // 前端页面调用等同步返回，返回修改成功的实例以及没有修改成功的实例 | ||
| batch, err := input.ModifyMysqlAdminPassword() | ||
| if input.Async == false { | ||
| SendResponse(c, err, batch) | ||
| } | ||
| return | ||
| } |
45 changes: 45 additions & 0 deletions
45
dbm-services/mysql/db-priv/handler/generate_random_string.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| package handler | ||
|
|
||
| import ( | ||
| "dbm-services/common/go-pubpkg/errno" | ||
| "dbm-services/mysql/priv-service/service" | ||
| "encoding/base64" | ||
| "encoding/json" | ||
| "io/ioutil" | ||
|
|
||
| "github.com/gin-gonic/gin" | ||
| "golang.org/x/exp/slog" | ||
| ) | ||
|
|
||
| // GenerateRandomString 生成随机化密码 | ||
| func (m *PrivService) GenerateRandomString(c *gin.Context) { | ||
| slog.Info("do GenerateRandomString!") | ||
| var input service.GenerateRandomStringPara | ||
| body, err := ioutil.ReadAll(c.Request.Body) | ||
| if err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
|
|
||
| if err = json.Unmarshal(body, &input); err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
| if input.SecurityRuleName == "" { | ||
| SendResponse(c, errno.RuleNameNull, nil) | ||
| return | ||
| } | ||
| // 获取安全规则 | ||
| security, err := service.GetSecurityRule(input.SecurityRuleName) | ||
| if err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.RuleNameNull, nil) | ||
| return | ||
| } | ||
| password, err := service.GenerateRandomString(security) | ||
| // 传输base64，因为部分字符通过url传输会转义 | ||
| SendResponse(c, err, base64.StdEncoding.EncodeToString([]byte(password))) | ||
| return | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| package handler | ||
|
|
||
| import ( | ||
| "dbm-services/common/go-pubpkg/errno" | ||
| "dbm-services/mysql/priv-service/service" | ||
| "encoding/json" | ||
| "io/ioutil" | ||
|
|
||
| "github.com/gin-gonic/gin" | ||
| "golang.org/x/exp/slog" | ||
| ) | ||
|
|
||
| // GetRandomExclude 获取不参加随机化的业务 | ||
| func (m *PrivService) GetRandomExclude(c *gin.Context) { | ||
| slog.Info("do GetRandomExclude!") | ||
| var input service.RandomExcludePara | ||
| body, err := ioutil.ReadAll(c.Request.Body) | ||
| if err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
|
|
||
| if err = json.Unmarshal(body, &input); err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
| // 获取不参加随机化的业务 | ||
| exclude, err := input.GetRandomizeExclude() | ||
| SendResponse(c, err, exclude) | ||
| return | ||
| } | ||
|
|
||
| // ModifyRandomExclude 修改不参与随机化的业务 | ||
| func (m *PrivService) ModifyRandomExclude(c *gin.Context) { | ||
| slog.Info("do ModifyRandomExclude!") | ||
| var input service.RandomExcludePara | ||
|
|
||
| body, err := ioutil.ReadAll(c.Request.Body) | ||
| if err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
|
|
||
| if err = json.Unmarshal(body, &input); err != nil { | ||
| slog.Error("msg", err) | ||
| SendResponse(c, errno.ErrBind, err) | ||
| return | ||
| } | ||
| // 传入的业务列表替换当前业务列表 | ||
| err = input.ModifyRandomizeExclude(string(body)) | ||
| SendResponse(c, err, nil) | ||
| return | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.