Mr.X

#
# This file is part of Ansible
#
# Ansible is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# Ansible is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import absolute_import, division, print_function


__metaclass__ = type


DOCUMENTATION = """
module: nxos_snmp_user
extends_documentation_fragment:
- cisco.nxos.nxos
short_description: (deprecated, removed after 2024-01-01) Manages SNMP users for monitoring.
description:
- Manages SNMP user configuration.
version_added: 1.0.0
deprecated:
  alternative: nxos_snmp_server
  why: Updated modules released with more functionality
  removed_at_date: '2024-01-01'
author:
- Jason Edelman (@jedelman8)
notes:
- Tested against NXOSv 7.3.(0)D1(1) on VIRL
- Limited Support for Cisco MDS
- Authentication parameters not idempotent.
options:
  user:
    description:
    - Name of the user.
    required: true
    type: str
  group:
    description:
    - Group to which the user will belong to. If state = present, and the user is
      existing, the group is added to the user. If the user is not existing, user
      entry is created with this group argument. If state = absent, only the group
      is removed from the user entry. However, to maintain backward compatibility,
      if the existing user belongs to only one group, and if group argument is same
      as the existing user's group, then the user entry also is deleted.
    type: str
  authentication:
    description:
    - Authentication parameters for the user.
    choices:
    - md5
    - sha
    type: str
  pwd:
    description:
    - Authentication password when using md5 or sha. This is not idempotent
    type: str
  privacy:
    description:
    - Privacy password for the user. This is not idempotent
    type: str
  encrypt:
    description:
    - Enables AES-128 bit encryption when using privacy password.
    type: bool
  state:
    description:
    - Manage the state of the resource.
    default: present
    choices:
    - present
    - absent
    type: str
"""

EXAMPLES = """
- cisco.nxos.nxos_snmp_user:
    user: ntc
    group: network-operator
    authentication: md5
    pwd: test_password
"""

RETURN = """
commands:
    description: commands sent to the device
    returned: always
    type: list
    sample: ["snmp-server user ntc network-operator auth md5 test_password"]
"""

import re

from ansible.module_utils.basic import AnsibleModule

from ansible_collections.cisco.nxos.plugins.module_utils.network.nxos.nxos import (
    load_config,
    run_commands,
)


def execute_show_command(command, module, text=False):
    command = {"command": command, "output": "json"}
    if text:
        command["output"] = "text"

    return run_commands(module, command)


def flatten_list(command_lists):
    flat_command_list = []
    for command in command_lists:
        if isinstance(command, list):
            flat_command_list.extend(command)
        else:
            flat_command_list.append(command)
    return flat_command_list


def get_snmp_groups(module):
    data = execute_show_command("show snmp group", module)[0]
    group_list = []

    try:
        group_table = data["TABLE_role"]["ROW_role"]
        for group in group_table:
            group_list.append(group["role_name"])
    except (KeyError, AttributeError):
        return group_list

    return group_list


def get_snmp_user(user, module):
    command = "show snmp user {0}".format(user)
    body = execute_show_command(command, module, text=True)
    body_text = body[0]

    if "No such entry" not in body[0]:
        body = execute_show_command(command, module)

    resource = {}
    try:
        # The TABLE and ROW keys differ between NXOS platforms.
        if body[0].get("TABLE_snmp_user"):
            tablekey = "TABLE_snmp_user"
            rowkey = "ROW_snmp_user"
            tablegrpkey = "TABLE_snmp_group_names"
            rowgrpkey = "ROW_snmp_group_names"
            authkey = "auth_protocol"
            privkey = "priv_protocol"
            grpkey = "group_names"
        elif body[0].get("TABLE_snmp_users"):
            tablekey = "TABLE_snmp_users"
            rowkey = "ROW_snmp_users"
            tablegrpkey = "TABLE_groups"
            rowgrpkey = "ROW_groups"
            authkey = "auth"
            privkey = "priv"
            grpkey = "group"

        rt = body[0][tablekey][rowkey]
        # on some older platforms, all groups except the 1st one
        # are in list elements by themselves and they are
        # indexed by 'user'. This is due to a platform bug.
        # Get first element if rt is a list due to the bug
        # or if there is no bug, parse rt directly
        if isinstance(rt, list):
            resource_table = rt[0]
        else:
            resource_table = rt

        resource["user"] = user
        resource["authentication"] = str(resource_table[authkey]).strip()
        encrypt = str(resource_table[privkey]).strip()
        if encrypt.startswith("aes"):
            resource["encrypt"] = "aes-128"
        else:
            resource["encrypt"] = "none"

        groups = []
        if tablegrpkey in resource_table:
            group_table = resource_table[tablegrpkey][rowgrpkey]
            try:
                for group in group_table:
                    groups.append(str(group[grpkey]).strip())
            except TypeError:
                groups.append(str(group_table[grpkey]).strip())

            # Now for the platform bug case, get the groups
            if isinstance(rt, list):
                # remove 1st element from the list as this is parsed already
                rt.pop(0)
                # iterate through other elements indexed by
                # 'user' and add it to groups.
                for each in rt:
                    groups.append(each["user"].strip())

        # Some 'F' platforms use 'group' key instead
        elif "group" in resource_table:
            # single group is a string, multiple groups in a list
            groups = resource_table["group"]
            if isinstance(groups, str):
                groups = [groups]

        resource["group"] = groups

    except (KeyError, AttributeError, IndexError, TypeError):
        if not resource and body_text and "No such entry" not in body_text:
            # 6K and other platforms may not return structured output;
            # attempt to get state from text output
            resource = get_non_structured_snmp_user(body_text)

    return resource


def get_non_structured_snmp_user(body_text):
    # This method is a workaround for platforms that don't support structured
    # output for 'show snmp user <foo>'. This workaround may not work on all
    # platforms. Sample non-struct output:
    #
    # User                Auth  Priv(enforce) Groups              acl_filter
    # ____                ____  _____________ ______              __________
    # sample1             no    no            network-admin       ipv4:my_acl
    #                                         network-operator
    #                                         priv-11
    #         -OR-
    # sample2             md5   des(no)       priv-15
    #         -OR-
    # sample3             md5   aes-128(no)   network-admin
    resource = {}
    output = body_text.rsplit("__________")[-1]
    pat = re.compile(
        r"^(?P<user>\S+)\s+"
        r"(?P<auth>\S+)\s+"
        r"(?P<priv>[\w\d-]+)(?P<enforce>\([\w\d-]+\))*\s+"
        r"(?P<group>\S+)",
        re.M,
    )
    m = re.search(pat, output)
    if not m:
        return resource
    resource["user"] = m.group("user")
    resource["auth"] = m.group("auth")
    resource["encrypt"] = "aes-128" if "aes" in str(m.group("priv")) else "none"

    resource["group"] = [m.group("group")]
    more_groups = re.findall(r"^\s+([\w\d-]+)\s*$", output, re.M)
    if more_groups:
        resource["group"] += more_groups

    return resource


def remove_snmp_user(user, group=None):
    if group:
        return ["no snmp-server user {0} {1}".format(user, group)]
    else:
        return ["no snmp-server user {0}".format(user)]


def config_snmp_user(proposed, user, reset):
    if reset:
        commands = remove_snmp_user(user)
    else:
        commands = []

    if proposed.get("group"):
        cmd = "snmp-server user {0} {group}".format(user, **proposed)
    else:
        cmd = "snmp-server user {0}".format(user)

    auth = proposed.get("authentication", None)
    pwd = proposed.get("pwd", None)

    if auth and pwd:
        cmd += " auth {authentication} {pwd}".format(**proposed)

    encrypt = proposed.get("encrypt", None)
    privacy = proposed.get("privacy", None)

    if encrypt and privacy:
        cmd += " priv {encrypt} {privacy}".format(**proposed)
    elif privacy:
        cmd += " priv {privacy}".format(**proposed)

    if cmd:
        commands.append(cmd)

    return commands


def main():
    argument_spec = dict(
        user=dict(required=True, type="str"),
        group=dict(type="str"),
        pwd=dict(type="str", no_log=True),
        privacy=dict(type="str"),
        authentication=dict(choices=["md5", "sha"]),
        encrypt=dict(type="bool"),
        state=dict(choices=["absent", "present"], default="present"),
    )

    module = AnsibleModule(
        argument_spec=argument_spec,
        required_together=[["authentication", "pwd"], ["encrypt", "privacy"]],
        supports_check_mode=True,
    )

    warnings = list()
    results = {"changed": False, "commands": [], "warnings": warnings}

    user = module.params["user"]
    group = module.params["group"]
    pwd = module.params["pwd"]
    privacy = module.params["privacy"]
    encrypt = module.params["encrypt"]
    authentication = module.params["authentication"]
    state = module.params["state"]

    if privacy and encrypt:
        if not pwd and authentication:
            module.fail_json(
                msg="pwd and authentication must be provided " "when using privacy and encrypt",
            )

    if group and group not in get_snmp_groups(module):
        module.fail_json(msg="group not configured yet on switch.")

    existing = get_snmp_user(user, module)

    if state == "present" and existing:
        if group:
            if group not in existing["group"]:
                existing["group"] = None
            else:
                existing["group"] = group
        else:
            existing["group"] = None

    commands = []

    if state == "absent" and existing:
        if group:
            if group in existing["group"]:
                if len(existing["group"]) == 1:
                    commands.append(remove_snmp_user(user))
                else:
                    commands.append(remove_snmp_user(user, group))
        else:
            commands.append(remove_snmp_user(user))

    elif state == "present":
        reset = False

        args = dict(
            user=user,
            pwd=pwd,
            group=group,
            privacy=privacy,
            encrypt=encrypt,
            authentication=authentication,
        )
        proposed = dict((k, v) for k, v in args.items() if v is not None)

        if not existing:
            if encrypt:
                proposed["encrypt"] = "aes-128"
            commands.append(config_snmp_user(proposed, user, reset))

        elif existing:
            if encrypt and not existing["encrypt"].startswith("aes"):
                reset = True
                proposed["encrypt"] = "aes-128"

            delta = dict(set(proposed.items()).difference(existing.items()))

            if delta.get("pwd"):
                delta["authentication"] = authentication

            if delta and encrypt:
                delta["encrypt"] = "aes-128"

            if delta:
                command = config_snmp_user(delta, user, reset)
                commands.append(command)

    cmds = flatten_list(commands)
    if cmds:
        results["changed"] = True
        if not module.check_mode:
            load_config(module, cmds)

        if "configure" in cmds:
            cmds.pop(0)
        results["commands"] = cmds

    module.exit_json(**results)


if __name__ == "__main__":
    main()

Name	Type	Size	Permission
__pycache__	Folder		0755
storage	Folder		0755
__init__.py	File	0 B	0644
nxos_aaa_server.py	File	10.19 KB	0644
nxos_aaa_server_host.py	File	10.92 KB	0644
nxos_acl_interfaces.py	File	10.21 KB	0644
nxos_acls.py	File	28.71 KB	0644
nxos_banner.py	File	6.44 KB	0644
nxos_bfd_global.py	File	9.08 KB	0644
nxos_bfd_interfaces.py	File	6.84 KB	0644
nxos_bgp.py	File	25.3 KB	0644
nxos_bgp_address_family.py	File	30.41 KB	0644
nxos_bgp_af.py	File	31.01 KB	0644
nxos_bgp_global.py	File	48.43 KB	0644
nxos_bgp_neighbor.py	File	18.79 KB	0644
nxos_bgp_neighbor_address_family.py	File	33.62 KB	0644
nxos_bgp_neighbor_af.py	File	26.84 KB	0644
nxos_command.py	File	7.41 KB	0644
nxos_config.py	File	22.51 KB	0644
nxos_devicealias.py	File	18.33 KB	0644
nxos_evpn_global.py	File	2.62 KB	0644
nxos_evpn_vni.py	File	9.44 KB	0644
nxos_facts.py	File	8.52 KB	0644
nxos_feature.py	File	9.21 KB	0644
nxos_file_copy.py	File	17.39 KB	0644
nxos_gir.py	File	11.5 KB	0644
nxos_gir_profile_management.py	File	5.84 KB	0644
nxos_hostname.py	File	5.63 KB	0644
nxos_hsrp.py	File	15.02 KB	0644
nxos_hsrp_interfaces.py	File	6.16 KB	0644
nxos_igmp.py	File	4.49 KB	0644
nxos_igmp_interface.py	File	21.88 KB	0644
nxos_igmp_snooping.py	File	9.72 KB	0644
nxos_install_os.py	File	21.07 KB	0644
nxos_interfaces.py	File	13.69 KB	0644
nxos_l2_interfaces.py	File	12.05 KB	0644
nxos_l3_interfaces.py	File	15.12 KB	0644
nxos_lacp.py	File	6.39 KB	0644
nxos_lacp_interfaces.py	File	9.13 KB	0644
nxos_lag_interfaces.py	File	8.66 KB	0644
nxos_lldp_global.py	File	8.68 KB	0644
nxos_lldp_interfaces.py	File	6.21 KB	0644
nxos_logging.py	File	27.52 KB	0644
nxos_logging_global.py	File	21.08 KB	0644
nxos_ntp.py	File	12.98 KB	0644
nxos_ntp_auth.py	File	9.17 KB	0644
nxos_ntp_global.py	File	19.63 KB	0644
nxos_ntp_options.py	File	4.53 KB	0644
nxos_nxapi.py	File	14.01 KB	0644
nxos_ospf_interfaces.py	File	43.32 KB	0644
nxos_ospfv2.py	File	62.64 KB	0644
nxos_ospfv3.py	File	53.01 KB	0644
nxos_overlay_global.py	File	5.64 KB	0644
nxos_pim.py	File	6.15 KB	0644
nxos_pim_interface.py	File	19.74 KB	0644
nxos_pim_rp_address.py	File	7.61 KB	0644
nxos_ping.py	File	7.05 KB	0644
nxos_prefix_lists.py	File	26.39 KB	0644
nxos_reboot.py	File	2.24 KB	0644
nxos_rollback.py	File	3.51 KB	0644
nxos_route_maps.py	File	57.7 KB	0644
nxos_rpm.py	File	12.29 KB	0644
nxos_snapshot.py	File	12.17 KB	0644
nxos_snmp_community.py	File	6.6 KB	0644
nxos_snmp_contact.py	File	3.81 KB	0644
nxos_snmp_host.py	File	15.1 KB	0644
nxos_snmp_location.py	File	3.91 KB	0644
nxos_snmp_server.py	File	50.27 KB	0644
nxos_snmp_traps.py	File	7.97 KB	0644
nxos_snmp_user.py	File	12.34 KB	0644
nxos_static_routes.py	File	20.79 KB	0644
nxos_system.py	File	12.77 KB	0644
nxos_telemetry.py	File	8.98 KB	0644
nxos_udld.py	File	7.09 KB	0644
nxos_udld_interface.py	File	8.51 KB	0644
nxos_user.py	File	15.37 KB	0644
nxos_vlans.py	File	10.6 KB	0644
nxos_vpc.py	File	15.59 KB	0644
nxos_vpc_interface.py	File	9.92 KB	0644
nxos_vrf.py	File	19.78 KB	0644
nxos_vrf_af.py	File	7.71 KB	0644
nxos_vrf_interface.py	File	7.37 KB	0644
nxos_vrrp.py	File	12 KB	0644
nxos_vsan.py	File	10.8 KB	0644
nxos_vtp_domain.py	File	5.73 KB	0644
nxos_vtp_password.py	File	7.8 KB	0644
nxos_vtp_version.py	File	5.54 KB	0644
nxos_vxlan_vtep.py	File	16.86 KB	0644
nxos_vxlan_vtep_vni.py	File	15.7 KB	0644
nxos_zone_zoneset.py	File	33.96 KB	0644

Upload:

Command:

Filemanager

Server Info

System Info