[Update] Merge branch dev_beta to branch dev_beta_db

apps/assets/models/node.py

@@ -212,12 +212,13 @@ class AssetsAmountMixin:
         if cached is not None:
             return cached
         assets_amount = self.get_all_assets().count()
-        cache.set(cache_key, assets_amount, self.cache_time)
         return assets_amount
 
     @assets_amount.setter
     def assets_amount(self, value):
         self._assets_amount = value
+        cache_key = self._assets_amount_cache_key.format(self.key)
+        cache.set(cache_key, value, self.cache_time)
 
     def expire_assets_amount(self):
         ancestor_keys = self.get_ancestor_keys(with_self=True)

apps/assets/serializers/base.py

@@ -59,6 +59,7 @@ class AuthSerializerMixin:
             value = validated_data.get(field)
             if not value:
                 validated_data.pop(field, None)
+
         # print(validated_data)
         # raise serializers.ValidationError(">>>>>>")
 

apps/assets/serializers/system_user.py

@@ -3,6 +3,7 @@ from rest_framework import serializers
 from django.utils.translation import ugettext_lazy as _
 
 from common.serializers import AdaptedBulkListSerializer
+from common.utils import ssh_pubkey_gen
 from orgs.mixins import BulkOrgResourceModelSerializer
 from ..models import SystemUser
 from .base import AuthSerializer, AuthSerializerMixin
@@ -71,7 +72,9 @@ class SystemUserSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
         super().validate_password(password)
         auto_gen_key = self.initial_data.get("auto_generate_key", False)
         private_key = self.initial_data.get("private_key")
-        if not self.instance and not auto_gen_key and not password and not private_key:
+        login_mode = self.initial_data.get("login_mode")
+        if not self.instance and not auto_gen_key and not password and \
+                not private_key and login_mode == SystemUser.LOGIN_AUTO:
             raise serializers.ValidationError(_("Password or private key required"))
         return password
 
@@ -86,6 +89,13 @@ class SystemUserSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
                 private_key, public_key = SystemUser.gen_key(username)
                 attrs["private_key"] = private_key
                 attrs["public_key"] = public_key
+                # 如果设置了private key，没有设置public key则生成
+        elif attrs.get("private_key", None):
+            private_key = attrs["private_key"]
+            password = attrs.get("password")
+            public_key = ssh_pubkey_gen(private_key, password=password,
+                                        username=username)
+            attrs["public_key"] = public_key
         attrs.pop("auto_generate_key", None)
         return attrs
 

apps/assets/signals_handler.py

@@ -112,6 +112,7 @@ def on_node_assets_changed(sender, instance=None, **kwargs):
 @receiver(post_save, sender=Node)
 def on_node_update_or_created(sender, instance=None, created=False, **kwargs):
     if instance and not created:
+        Asset.expire_all_nodes_keys_cache()
         instance.expire_full_value()
 
 

apps/assets/urls/api_urls.py

@@ -94,10 +94,8 @@ urlpatterns = [
 ]
 
 old_version_urlpatterns = [
-    re_path('(?P<resource>admin_user|system_user|domain|gateway|cmd-filter|asset-user)/.*', capi.redirect_plural_name_api)
+    re_path('(?P<resource>admin-user|system-user|domain|gateway|cmd-filter|asset-user)/.*', capi.redirect_plural_name_api)
 ]
 
-urlpatterns += router.urls + old_version_urlpatterns
-
-urlpatterns += router.urls + cmd_filter_router.urls
+urlpatterns += router.urls + cmd_filter_router.urls + old_version_urlpatterns
 

apps/audits/apps.py

 from django.apps import AppConfig
+from django.conf import settings
+from django.db.models.signals import post_save
 
 
 class AuditsConfig(AppConfig):
@@ -6,3 +8,5 @@ class AuditsConfig(AppConfig):
 
     def ready(self):
         from . import signals_handler
+        if settings.SYSLOG_ENABLE:
+            post_save.connect(signals_handler.on_audits_log_create)

apps/audits/serializers.py

@@ -3,11 +3,36 @@
 
 from rest_framework import serializers
 
-from .models import FTPLog
+from terminal.models import Session
+from . import models
 
 
 class FTPLogSerializer(serializers.ModelSerializer):
 
     class Meta:
-        model = FTPLog
+        model = models.FTPLog
+        fields = '__all__'
+
+
+class LoginLogSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = models.UserLoginLog
+        fields = '__all__'
+
+
+class OperateLogSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = models.OperateLog
+        fields = '__all__'
+
+
+class PasswordChangeLogSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = models.PasswordChangeLog
+        fields = '__all__'
+
+
+class SessionAuditSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Session
         fields = '__all__'

apps/audits/signals_handler.py

@@ -4,13 +4,18 @@
 from django.db.models.signals import post_save, post_delete
 from django.dispatch import receiver
 from django.db import transaction
+from rest_framework.renderers import JSONRenderer
 
 from jumpserver.utils import current_request
-from common.utils import get_request_ip, get_logger
+from common.utils import get_request_ip, get_logger, get_syslogger
 from users.models import User
-from .models import OperateLog, PasswordChangeLog
+from terminal.models import Session
+from . import models
+from . import serializers
 
 logger = get_logger(__name__)
+sys_logger = get_syslogger("audits")
+json_render = JSONRenderer()
 
 
 MODELS_NEED_RECORD = (
@@ -36,7 +41,7 @@ def create_operate_log(action, sender, resource):
     }
     with transaction.atomic():
         try:
-            OperateLog.objects.create(**data)
+            models.OperateLog.objects.create(**data)
         except Exception as e:
             logger.error("Create operate log error: {}".format(e))
 
@@ -44,15 +49,15 @@ def create_operate_log(action, sender, resource):
 @receiver(post_save, dispatch_uid="my_unique_identifier")
 def on_object_created_or_update(sender, instance=None, created=False, **kwargs):
     if created:
-        action = OperateLog.ACTION_CREATE
+        action = models.OperateLog.ACTION_CREATE
     else:
-        action = OperateLog.ACTION_UPDATE
+        action = models.OperateLog.ACTION_UPDATE
     create_operate_log(action, sender, instance)
 
 
 @receiver(post_delete, dispatch_uid="my_unique_identifier")
 def on_object_delete(sender, instance=None, **kwargs):
-    create_operate_log(OperateLog.ACTION_DELETE, sender, instance)
+    create_operate_log(models.OperateLog.ACTION_DELETE, sender, instance)
 
 
 @receiver(post_save, sender=User, dispatch_uid="my_unique_identifier")
@@ -61,7 +66,32 @@ def on_user_change_password(sender, instance=None, **kwargs):
         if not current_request or not current_request.user.is_authenticated:
             return
         with transaction.atomic():
-            PasswordChangeLog.objects.create(
+            models.PasswordChangeLog.objects.create(
                 user=instance, change_by=current_request.user,
                 remote_addr=get_request_ip(current_request),
             )
+
+
+def on_audits_log_create(sender, instance=None, **kwargs):
+    if sender == models.UserLoginLog:
+        category = "login_log"
+        serializer = serializers.LoginLogSerializer
+    elif sender == models.FTPLog:
+        serializer = serializers.FTPLogSerializer
+        category = "ftp_log"
+    elif sender == models.OperateLog:
+        category = "operation_log"
+        serializer = serializers.OperateLogSerializer
+    elif sender == models.PasswordChangeLog:
+        category = "password_change_log"
+        serializer = serializers.PasswordChangeLogSerializer
+    elif sender == Session:
+        category = "host_session_log"
+        serializer = serializers.SessionAuditSerializer
+    else:
+        return
+
+    s = serializer(instance=instance)
+    data = json_render.render(s.data).decode(errors='ignore')
+    msg = "{} - {}".format(category, data)
+    sys_logger.info(msg)

apps/authentication/forms.py

@@ -5,6 +5,8 @@ from django import forms
 from django.contrib.auth.forms import AuthenticationForm
 from django.utils.translation import gettext_lazy as _
 from captcha.fields import CaptchaField
+from django.conf import settings
+from users.utils import get_login_failed_count
 
 
 class UserLoginForm(AuthenticationForm):
@@ -16,10 +18,18 @@ class UserLoginForm(AuthenticationForm):
 
     error_messages = {
         'invalid_login': _(
-            "Please enter a correct username and password. Note that both "
-            "fields may be case-sensitive."
+            "The username or password you entered is incorrect, "
+            "please enter it again."
         ),
         'inactive': _("This account is inactive."),
+        'limit_login': _(
+            "You can also try {times_try} times "
+            "(The account will be temporarily locked for {block_time} minutes)"
+        ),
+        'block_login': _(
+            "The account has been locked "
+            "(please contact admin to unlock it or try again after {} minutes)"
+        )
     }
 
     def confirm_login_allowed(self, user):
@@ -28,6 +38,25 @@ class UserLoginForm(AuthenticationForm):
                 self.error_messages['inactive'],
                 code='inactive',)
 
+    def get_limit_login_error_message(self, username, ip):
+        times_up = settings.SECURITY_LOGIN_LIMIT_COUNT
+        times_failed = get_login_failed_count(username, ip)
+        times_try = int(times_up) - int(times_failed)
+        block_time = settings.SECURITY_LOGIN_LIMIT_TIME
+        if times_try <= 0:
+            error_message = self.error_messages['block_login']
+            error_message = error_message.format(block_time)
+        else:
+            error_message = self.error_messages['limit_login']
+            error_message = error_message.format(
+                times_try=times_try, block_time=block_time,
+            )
+        return error_message
+
+    def add_limit_login_error(self, username, ip):
+        error = self.get_limit_login_error_message(username, ip)
+        self.add_error('password', error)
+
 
 class UserLoginCaptchaForm(UserLoginForm):
     captcha = CaptchaField()

apps/authentication/templates/authentication/login.html

@@ -58,6 +58,7 @@
                             {% else %}
                                 <p class="red-fonts">{{ form.non_field_errors.as_text }}</p>
                             {% endif %}
+                            <p class="red-fonts">{{ form.errors.password.as_text }}</p>
                         {% endif %}
 
                         <div class="form-group">
@@ -78,10 +79,11 @@
                         {% endif %}
 
                         <div class="text-muted text-center">
-                        <div>
-                            <a href="{% url 'users:forgot-password' %}">
-                                <small>{% trans 'Forgot password' %}?</small>
-                            </a>
+                            <div>
+                                <a href="{% url 'users:forgot-password' %}">
+                                    <small>{% trans 'Forgot password' %}?</small>
+                                </a>
+                            </div>
                         </div>
 
                         {% if AUTH_OPENID %}

apps/authentication/templates/authentication/new_login.html

@@ -72,9 +72,10 @@
                             <div class="contact-form col-md-10" style="margin-top: 10px;height: 35px">
                                 <form id="contact-form" action="" method="post" role="form" novalidate="novalidate">
                                     {% csrf_token %}
-                                    <div style="height: 45px;color: red;line-height: 17px;">
+                                    <div style="height: 70px;color: red;line-height: 17px;">
                                         {% if block_login %}
                                             <p class="red-fonts">{% trans 'Log in frequently and try again later' %}</p>
+                                            <p class="red-fonts">{{ form.errors.password.as_text }}</p>
                                         {% elif password_expired %}
                                             <p class="red-fonts">{% trans 'The user password has expired' %}</p>
                                         {% elif form.errors %}
@@ -83,6 +84,7 @@
                                             {% else %}
                                                 <p class="red-fonts">{{ form.non_field_errors.as_text }}</p>
                                             {% endif %}
+                                            <p class="red-fonts">{{ form.errors.password.as_text }}</p>
                                         {% endif %}
                                     </div>
 

apps/authentication/views/login.py

@@ -26,6 +26,7 @@ from users.utils import (
 )
 from ..signals import post_auth_success, post_auth_failed
 from .. import forms
+from .. import const
 
 
 __all__ = [
@@ -77,7 +78,7 @@ class UserLoginView(FormView):
         user = form.get_user()
         # user password expired
         if user.password_has_expired:
-            reason = LoginLog.REASON_PASSWORD_EXPIRED
+            reason = const.password_expired
             self.send_auth_signal(success=False, username=user.username, reason=reason)
             return self.render_to_response(self.get_context_data(password_expired=True))
 
@@ -92,10 +93,11 @@ class UserLoginView(FormView):
         # write login failed log
         username = form.cleaned_data.get('username')
         exist = User.objects.filter(username=username).first()
-        reason = LoginLog.REASON_PASSWORD if exist else LoginLog.REASON_NOT_EXIST
+        reason = const.password_failed if exist else const.user_not_exist
         # limit user login failed count
         ip = get_request_ip(self.request)
         increase_login_failed_count(username, ip)
+        form.add_limit_login_error(username, ip)
         # show captcha
         cache.set(self.key_prefix_captcha.format(ip), 1, 3600)
         self.send_auth_signal(success=False, username=username, reason=reason)
@@ -162,7 +164,7 @@ class UserLoginOtpView(FormView):
         else:
             self.send_auth_signal(
                 success=False, username=user.username,
-                reason=LoginLog.REASON_MFA
+                reason=const.mfa_failed
             )
             form.add_error(
                 'otp_code', _('MFA code invalid, or ntp sync server time')

apps/common/permissions.py

@@ -49,6 +49,8 @@ class IsOrgAdmin(IsValidUser):
     """Allows access only to superuser"""
 
     def has_permission(self, request, view):
+        if not current_org:
+            return False
         return super(IsOrgAdmin, self).has_permission(request, view) \
             and current_org.can_admin_by(request.user)
 
@@ -57,6 +59,8 @@ class IsOrgAdminOrAppUser(IsValidUser):
     """Allows access between superuser and app user"""
 
     def has_permission(self, request, view):
+        if not current_org:
+            return False
         return super(IsOrgAdminOrAppUser, self).has_permission(request, view) \
             and (current_org.can_admin_by(request.user) or request.user.is_app)
 

apps/common/tasks.py

@@ -29,6 +29,6 @@ def send_mail_async(*args, **kwargs):
         args = tuple(args)
 
     try:
-        send_mail(*args, **kwargs)
+        return send_mail(*args, **kwargs)
     except Exception as e:
         logger.error("Sending mail error: {}".format(e))

apps/common/utils/common.py

@@ -31,6 +31,10 @@ def get_logger(name=None):
     return logging.getLogger('jumpserver.%s' % name)
 
 
+def get_syslogger(name=None):
+    return logging.getLogger('jms.%s' % name)
+
+
 def timesince(dt, since='', default="just now"):
     """
     Returns string representing "time since" e.g.

apps/jumpserver/conf.py

@@ -379,6 +379,8 @@ defaults = {
     'ASSETS_PERM_CACHE_TIME': 3600*24,
     'SECURITY_MFA_VERIFY_TTL': 3600,
     'ASSETS_PERM_CACHE_ENABLE': False,
+    'SYSLOG_ADDR': '',  # '192.168.0.1:514'
+    'SYSLOG_FACILITY': 'user',
 }
 
 

apps/jumpserver/settings.py

@@ -214,6 +214,9 @@ LOGGING = {
         'simple': {
             'format': '%(levelname)s %(message)s'
         },
+        'syslog': {
+            'format': 'jumpserver: %(message)s'
+        },
         'msg': {
             'format': '%(message)s'
         }
@@ -246,19 +249,10 @@ LOGGING = {
             'backupCount': 7,
             'filename': ANSIBLE_LOG_FILE,
         },
-        'gunicorn_file': {
-            'encoding': 'utf8',
-            'level': 'DEBUG',
-            'class': 'logging.handlers.RotatingFileHandler',
-            'formatter': 'msg',
-            'maxBytes': 1024*1024*100,
-            'backupCount': 2,
-            'filename': GUNICORN_LOG_FILE,
-        },
-        'gunicorn_console': {
-            'level': 'DEBUG',
-            'class': 'logging.StreamHandler',
-            'formatter': 'msg'
+        'syslog': {
+            'level': 'INFO',
+            'class': 'logging.NullHandler',
+            'formatter': 'syslog'
         },
     },
     'loggers': {
@@ -268,25 +262,17 @@ LOGGING = {
             'level': LOG_LEVEL,
         },
         'django.request': {
-            'handlers': ['console', 'file'],
+            'handlers': ['console', 'file', 'syslog'],
             'level': LOG_LEVEL,
             'propagate': False,
         },
         'django.server': {
-            'handlers': ['console', 'file'],
+            'handlers': ['console', 'file', 'syslog'],
             'level': LOG_LEVEL,
             'propagate': False,
         },
         'jumpserver': {
-            'handlers': ['console', 'file'],
-            'level': LOG_LEVEL,
-        },
-        'jumpserver.users.api': {
-            'handlers': ['console', 'file'],
-            'level': LOG_LEVEL,
-        },
-        'jumpserver.users.view': {
-            'handlers': ['console', 'file'],
+            'handlers': ['console', 'file', 'syslog'],
             'level': LOG_LEVEL,
         },
         'ops.ansible_api': {
@@ -297,10 +283,10 @@ LOGGING = {
             'handlers': ['console', 'file'],
             'level': "INFO",
         },
-        # 'gunicorn': {
-        #     'handlers': ['gunicorn_console', 'gunicorn_file'],
-        #     'level': 'INFO',
-        # },
+        'jms_audits': {
+            'handlers': ['syslog'],
+            'level': 'INFO'
+        },
         # 'django.db': {
         #     'handlers': ['console', 'file'],
         #     'level': 'DEBUG'
@@ -308,6 +294,17 @@ LOGGING = {
     }
 }
 
+SYSLOG_ENABLE = False
+
+if CONFIG.SYSLOG_ADDR != '' and len(CONFIG.SYSLOG_ADDR.split(':')) == 2:
+    host, port = CONFIG.SYSLOG_ADDR.split(':')
+    SYSLOG_ENABLE = True
+    LOGGING['handlers']['syslog'].update({
+        'class': 'logging.handlers.SysLogHandler',
+        'facility': CONFIG.SYSLOG_FACILITY,
+        'address': (host, int(port)),
+    })
+
 # Internationalization
 # https://docs.djangoproject.com/en/1.10/topics/i18n/
 # LANGUAGE_CODE = 'en'

apps/locale/zh/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Jumpserver 0.3.3\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2019-08-06 15:41+0800\n"
+"POT-Creation-Date: 2019-08-09 14:57+0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: ibuler <ibuler@qq.com>\n"
 "Language-Team: Jumpserver team<ibuler@qq.com>\n"
@@ -38,9 +38,9 @@ msgstr "自定义"
 #: assets/serializers/asset_user.py:62
 #: assets/templates/assets/_asset_user_auth_update_modal.html:21
 #: assets/templates/assets/_asset_user_auth_view_modal.html:27
-#: authentication/forms.py:13
-#: authentication/templates/authentication/login.html:67
-#: authentication/templates/authentication/new_login.html:93
+#: authentication/forms.py:15
+#: authentication/templates/authentication/login.html:68
+#: authentication/templates/authentication/new_login.html:95
 #: settings/forms.py:110 users/forms.py:16 users/forms.py:28
 #: users/templates/users/reset_password.html:53
 #: users/templates/users/user_password_authentication.html:18
@@ -104,7 +104,7 @@ msgstr "运行参数"
 #: assets/forms/domain.py:15 assets/forms/label.py:13
 #: assets/models/asset.py:318 assets/models/authbook.py:24
 #: assets/serializers/admin_user.py:32 assets/serializers/asset_user.py:81
-#: assets/serializers/system_user.py:30
+#: assets/serializers/system_user.py:31
 #: assets/templates/assets/admin_user_list.html:46
 #: assets/templates/assets/domain_detail.html:60
 #: assets/templates/assets/domain_list.html:26
@@ -212,7 +212,7 @@ msgstr ""
 #: settings/templates/settings/terminal_setting.html:105 terminal/models.py:24
 #: terminal/models.py:261 terminal/templates/terminal/terminal_detail.html:43
 #: terminal/templates/terminal/terminal_list.html:29 users/models/group.py:14
-#: users/models/user.py:331 users/templates/users/_select_user_modal.html:13
+#: users/models/user.py:330 users/templates/users/_select_user_modal.html:13
 #: users/templates/users/user_detail.html:63
 #: users/templates/users/user_group_detail.html:55
 #: users/templates/users/user_group_list.html:35
@@ -308,7 +308,7 @@ msgstr "端口"
 #: terminal/templates/terminal/command_list.html:65
 #: terminal/templates/terminal/session_list.html:27
 #: terminal/templates/terminal/session_list.html:71 users/forms.py:316
-#: users/models/user.py:127 users/models/user.py:446
+#: users/models/user.py:127 users/models/user.py:457
 #: users/serializers/v1.py:108 users/templates/users/user_group_detail.html:78
 #: users/templates/users/user_group_list.html:36 users/views/user.py:243
 #: xpack/plugins/orgs/forms.py:26
@@ -363,7 +363,7 @@ msgstr "数据库"
 #: perms/templates/perms/remote_app_permission_detail.html:94
 #: settings/models.py:34 terminal/models.py:34
 #: terminal/templates/terminal/terminal_detail.html:63 users/models/group.py:15
-#: users/models/user.py:364 users/templates/users/user_detail.html:129
+#: users/models/user.py:363 users/templates/users/user_detail.html:129
 #: users/templates/users/user_group_detail.html:67
 #: users/templates/users/user_group_list.html:37
 #: users/templates/users/user_profile.html:138
@@ -396,7 +396,7 @@ msgstr "备注"
 #: perms/templates/perms/asset_permission_detail.html:98
 #: perms/templates/perms/database_permission_detail.html:90
 #: perms/templates/perms/remote_app_permission_detail.html:90
-#: users/models/user.py:372 users/serializers/v1.py:119
+#: users/models/user.py:371 users/serializers/v1.py:119
 #: users/templates/users/user_detail.html:111
 #: xpack/plugins/change_auth_plan/models.py:106
 #: xpack/plugins/change_auth_plan/templates/change_auth_plan/plan_detail.html:113
@@ -874,7 +874,7 @@ msgid "Domain"
 msgstr "网域"
 
 #: assets/forms/asset.py:58 assets/forms/asset.py:80 assets/forms/asset.py:93
-#: assets/forms/asset.py:128 assets/models/node.py:253
+#: assets/forms/asset.py:128 assets/models/node.py:254
 #: assets/templates/assets/asset_create.html:42
 #: perms/forms/asset_permission.py:72 perms/forms/asset_permission.py:79
 #: perms/models/asset_permission.py:112
@@ -937,15 +937,15 @@ msgstr "SSH网关，支持代理SSH,RDP和VNC"
 #: assets/templates/assets/domain_gateway_list.html:71
 #: assets/templates/assets/system_user_detail.html:62
 #: assets/templates/assets/system_user_list.html:52 audits/models.py:80
-#: audits/templates/audits/login_log_list.html:51 authentication/forms.py:11
-#: authentication/templates/authentication/login.html:64
-#: authentication/templates/authentication/new_login.html:90
+#: audits/templates/audits/login_log_list.html:51 authentication/forms.py:13
+#: authentication/templates/authentication/login.html:65
+#: authentication/templates/authentication/new_login.html:92
 #: ops/models/adhoc.py:164 perms/templates/perms/asset_permission_list.html:70
 #: perms/templates/perms/asset_permission_user.html:55
 #: perms/templates/perms/database_permission_user.html:54
 #: perms/templates/perms/remote_app_permission_user.html:54
 #: settings/templates/settings/_ldap_list_users_modal.html:37 users/forms.py:14
-#: users/models/user.py:329 users/templates/users/_select_user_modal.html:14
+#: users/models/user.py:328 users/templates/users/_select_user_modal.html:14
 #: users/templates/users/user_detail.html:67
 #: users/templates/users/user_list.html:36
 #: users/templates/users/user_profile.html:47
@@ -965,7 +965,7 @@ msgstr "密码或密钥密码"
 
 #: assets/forms/user.py:29 assets/serializers/asset_user.py:70
 #: assets/templates/assets/_asset_user_auth_update_modal.html:27
-#: users/models/user.py:358
+#: users/models/user.py:357
 msgid "Private key"
 msgstr "ssh私钥"
 
@@ -1166,7 +1166,7 @@ msgstr "带宽"
 msgid "Contact"
 msgstr "联系人"
 
-#: assets/models/cluster.py:22 users/models/user.py:350
+#: assets/models/cluster.py:22 users/models/user.py:349
 #: users/templates/users/user_detail.html:76
 msgid "Phone"
 msgstr "手机"
@@ -1192,7 +1192,7 @@ msgid "Default"
 msgstr "默认"
 
 #: assets/models/cluster.py:36 assets/models/label.py:14
-#: users/models/user.py:458
+#: users/models/user.py:469
 msgid "System"
 msgstr "系统"
 
@@ -1279,7 +1279,7 @@ msgstr "资产组"
 msgid "Default asset group"
 msgstr "默认资产组"
 
-#: assets/models/label.py:19 assets/models/node.py:244
+#: assets/models/label.py:19 assets/models/node.py:245
 #: assets/templates/assets/label_list.html:15 settings/models.py:30
 msgid "Value"
 msgstr "值"
@@ -1288,11 +1288,11 @@ msgstr "值"
 msgid "Category"
 msgstr "分类"
 
-#: assets/models/node.py:243
+#: assets/models/node.py:244
 msgid "Key"
 msgstr "键"
 
-#: assets/models/node.py:301
+#: assets/models/node.py:302
 msgid "New node"
 msgstr "新节点"
 
@@ -1364,7 +1364,7 @@ msgid "Backend"
 msgstr "后端"
 
 #: assets/serializers/asset_user.py:66 users/forms.py:263
-#: users/models/user.py:361 users/templates/users/first_login.html:42
+#: users/models/user.py:360 users/templates/users/first_login.html:42
 #: users/templates/users/user_password_update.html:49
 #: users/templates/users/user_profile.html:69
 #: users/templates/users/user_profile_update.html:46
@@ -1385,15 +1385,15 @@ msgstr "密钥不合法"
 msgid "The same level node name cannot be the same"
 msgstr "同级别节点名字不能重复"
 
-#: assets/serializers/system_user.py:31
+#: assets/serializers/system_user.py:32
 msgid "Login mode display"
 msgstr "登录模式显示"
 
-#: assets/serializers/system_user.py:66
+#: assets/serializers/system_user.py:67
 msgid "* Automatic login mode must fill in the username."
 msgstr "自动登录模式，必须填写用户名"
 
-#: assets/serializers/system_user.py:75
+#: assets/serializers/system_user.py:78
 msgid "Password or private key required"
 msgstr "密码或密钥密码需要一个"
 
@@ -2323,7 +2323,7 @@ msgstr "Agent"
 
 #: audits/models.py:85 audits/templates/audits/login_log_list.html:56
 #: authentication/templates/authentication/_mfa_confirm_modal.html:14
-#: users/forms.py:175 users/models/user.py:353
+#: users/forms.py:175 users/models/user.py:352
 #: users/templates/users/first_login.html:45
 msgid "MFA"
 msgstr "MFA"
@@ -2527,17 +2527,29 @@ msgstr "密码过期"
 msgid "Disabled or expired"
 msgstr "禁用或失效"
 
-#: authentication/forms.py:19
+#: authentication/forms.py:21
 msgid ""
-"Please enter a correct username and password. Note that both fields may be "
-"case-sensitive."
-msgstr "请输入正确的用户名和密码. 注意它们是区分大小写."
+"The username or password you entered is incorrect, please enter it again."
+msgstr "您输入的用户名或密码不正确，请重新输入。"
 
-#: authentication/forms.py:22
+#: authentication/forms.py:24
 msgid "This account is inactive."
 msgstr "此账户无效"
 
-#: authentication/forms.py:37 users/forms.py:22
+#: authentication/forms.py:26
+#, python-brace-format
+msgid ""
+"You can also try {times_try} times (The account will be temporarily locked "
+"for {block_time} minutes)"
+msgstr "您还可以尝试 {times_try} 次（账号将被临时锁定 {block_time} 分钟）"
+
+#: authentication/forms.py:30
+msgid ""
+"The account has been locked (please contact admin to unlock it or try again "
+"after {} minutes)"
+msgstr "账号已被锁定（请联系管理员解锁 或 {}分钟后重试）"
+
+#: authentication/forms.py:66 users/forms.py:22
 msgid "MFA code"
 msgstr "MFA 验证码"
 
@@ -2566,14 +2578,14 @@ msgid "Show"
 msgstr "显示"
 
 #: authentication/templates/authentication/_access_key_modal.html:66
-#: users/models/user.py:288 users/templates/users/user_profile.html:94
+#: users/models/user.py:287 users/templates/users/user_profile.html:94
 #: users/templates/users/user_profile.html:163
 #: users/templates/users/user_profile.html:166
 msgid "Disable"
 msgstr "禁用"
 
 #: authentication/templates/authentication/_access_key_modal.html:67
-#: users/models/user.py:289 users/templates/users/user_profile.html:92
+#: users/models/user.py:288 users/templates/users/user_profile.html:92
 #: users/templates/users/user_profile.html:170
 msgid "Enable"
 msgstr "启用"
@@ -2634,34 +2646,34 @@ msgid "Changes the world, starting with a little bit."
 msgstr "改变世界，从一点点开始。"
 
 #: authentication/templates/authentication/login.html:46
-#: authentication/templates/authentication/login.html:72
-#: authentication/templates/authentication/new_login.html:99
+#: authentication/templates/authentication/login.html:73
+#: authentication/templates/authentication/new_login.html:101
 #: templates/_header_bar.html:83
 msgid "Login"
 msgstr "登录"
 
 #: authentication/templates/authentication/login.html:54
-#: authentication/templates/authentication/new_login.html:79
+#: authentication/templates/authentication/new_login.html:80
 msgid "The user password has expired"
 msgstr "用户密码已过期"
 
 #: authentication/templates/authentication/login.html:57
-#: authentication/templates/authentication/new_login.html:82
+#: authentication/templates/authentication/new_login.html:83
 msgid "Captcha invalid"
 msgstr "验证码错误"
 
-#: authentication/templates/authentication/login.html:83
-#: authentication/templates/authentication/new_login.html:103
+#: authentication/templates/authentication/login.html:84
+#: authentication/templates/authentication/new_login.html:105
 #: users/templates/users/forgot_password.html:10
 #: users/templates/users/forgot_password.html:25
 msgid "Forgot password"
 msgstr "忘记密码"
 
-#: authentication/templates/authentication/login.html:89
+#: authentication/templates/authentication/login.html:91
 msgid "More login options"
 msgstr "更多登录方式"
 
-#: authentication/templates/authentication/login.html:93
+#: authentication/templates/authentication/login.html:95
 msgid "Keycloak"
 msgstr ""
 
@@ -2706,20 +2718,20 @@ msgstr "如果不能提供MFA验证码，请联系管理员!"
 msgid "Welcome back, please enter username and password to login"
 msgstr "欢迎回来，请输入用户名和密码登录"
 
-#: authentication/views/login.py:76
+#: authentication/views/login.py:77
 msgid "Please enable cookies and try again."
 msgstr "设置你的浏览器支持cookie"
 
-#: authentication/views/login.py:168 users/views/user.py:386
+#: authentication/views/login.py:170 users/views/user.py:386
 #: users/views/user.py:411
 msgid "MFA code invalid, or ntp sync server time"
 msgstr "MFA验证码不正确，或者服务器端时间不对"
 
-#: authentication/views/login.py:199
+#: authentication/views/login.py:201
 msgid "Logout success"
 msgstr "退出登录成功"
 
-#: authentication/views/login.py:200
+#: authentication/views/login.py:202
 msgid "Logout success, return login page"
 msgstr "退出登录成功，返回到登录页面"
 
@@ -3173,7 +3185,7 @@ msgstr "空"
 #: perms/templates/perms/database_permission_list.html:16
 #: perms/templates/perms/remote_app_permission_list.html:16
 #: templates/_nav.html:14 users/forms.py:286 users/models/group.py:26
-#: users/models/user.py:337 users/templates/users/_select_user_modal.html:16
+#: users/models/user.py:336 users/templates/users/_select_user_modal.html:16
 #: users/templates/users/user_detail.html:217
 #: users/templates/users/user_list.html:38
 #: xpack/plugins/orgs/templates/orgs/org_list.html:15
@@ -3223,7 +3235,7 @@ msgstr "资产授权"
 #: perms/templates/perms/asset_permission_detail.html:90
 #: perms/templates/perms/database_permission_detail.html:82
 #: perms/templates/perms/remote_app_permission_detail.html:82
-#: users/models/user.py:369 users/templates/users/user_detail.html:107
+#: users/models/user.py:368 users/templates/users/user_detail.html:107
 #: users/templates/users/user_profile.html:120
 msgid "Date expired"
 msgstr "失效日期"
@@ -3840,7 +3852,7 @@ msgid "Please submit the LDAP configuration before import"
 msgstr "请先提交LDAP配置再进行导入"
 
 #: settings/templates/settings/_ldap_list_users_modal.html:39
-#: users/models/user.py:333 users/templates/users/user_detail.html:71
+#: users/models/user.py:332 users/templates/users/user_detail.html:71
 #: users/templates/users/user_profile.html:59
 msgid "Email"
 msgstr "邮件"
@@ -4112,7 +4124,24 @@ msgstr "下载导入模版"
 msgid "Select the CSV file to import"
 msgstr "请选择csv文件导入"
 
-#: templates/_message.html:7
+#: templates/_message.html:6
+msgid ""
+"\n"
+"                Your account has expired, please contact the administrator.\n"
+"            "
+msgstr ""
+"\n"
+"                您的账户已经过期，请联系管理员。            "
+
+#: templates/_message.html:13
+msgid "Your account will at"
+msgstr "您的账户将于"
+
+#: templates/_message.html:13 templates/_message.html:30
+msgid "expired. "
+msgstr "过期。"
+
+#: templates/_message.html:23
 #, python-format
 msgid ""
 "\n"
@@ -4125,15 +4154,11 @@ msgstr ""
 "\"%(user_password_update_url)s\"> 链接 </a> 更新密码\n"
 "        "
 
-#: templates/_message.html:14
+#: templates/_message.html:30
 msgid "Your password will at"
 msgstr "您的密码将于"
 
-#: templates/_message.html:14
-msgid "expired. "
-msgstr "过期。"
-
-#: templates/_message.html:15
+#: templates/_message.html:31
 #, python-format
 msgid ""
 "\n"
@@ -4146,7 +4171,7 @@ msgstr ""
 "新密码\n"
 "        "
 
-#: templates/_message.html:27
+#: templates/_message.html:43
 #, python-format
 msgid ""
 "\n"
@@ -4159,7 +4184,7 @@ msgstr ""
 "</a> 补充完整\n"
 "                "
 
-#: templates/_message.html:40
+#: templates/_message.html:56
 #, python-format
 msgid ""
 "\n"
@@ -4627,7 +4652,7 @@ msgstr "你没有权限"
 msgid "Could not reset self otp, use profile reset instead"
 msgstr "不能再该页面重置MFA, 请去个人信息页面重置"
 
-#: users/forms.py:33 users/models/user.py:341
+#: users/forms.py:33 users/models/user.py:340
 #: users/templates/users/_select_user_modal.html:15
 #: users/templates/users/user_detail.html:87
 #: users/templates/users/user_list.html:37
@@ -4746,7 +4771,7 @@ msgstr "选择用户"
 msgid "User auth from {}, go there change password"
 msgstr "用户认证源来自 {}, 请去相应系统修改密码"
 
-#: users/models/user.py:126 users/models/user.py:454
+#: users/models/user.py:126 users/models/user.py:465
 msgid "Administrator"
 msgstr "管理员"
 
@@ -4758,29 +4783,39 @@ msgstr "应用程序"
 msgid "Auditor"
 msgstr "审计员"
 
-#: users/models/user.py:290 users/templates/users/user_profile.html:90
+# #: users/models/user.py:288 users/templates/users/user_profile.html:94
+# #: users/templates/users/user_profile.html:163
+# #: users/templates/users/user_profile.html:166
+# msgid "Disable"
+# msgstr "禁用"
+#
+# #: users/models/user.py:289 users/templates/users/user_profile.html:92
+# #: users/templates/users/user_profile.html:170
+# msgid "Enable"
+# msgstr "启用"
+#: users/models/user.py:289 users/templates/users/user_profile.html:90
 msgid "Force enable"
 msgstr "强制启用"
 
-#: users/models/user.py:344
+#: users/models/user.py:343
 msgid "Avatar"
 msgstr "头像"
 
-#: users/models/user.py:347 users/templates/users/user_detail.html:82
+#: users/models/user.py:346 users/templates/users/user_detail.html:82
 msgid "Wechat"
 msgstr "微信"
 
-#: users/models/user.py:376 users/templates/users/user_detail.html:103
+#: users/models/user.py:375 users/templates/users/user_detail.html:103
 #: users/templates/users/user_list.html:39
 #: users/templates/users/user_profile.html:102
 msgid "Source"
 msgstr "用户来源"
 
-#: users/models/user.py:380
+#: users/models/user.py:379
 msgid "Date password last updated"
 msgstr "最后更新密码日期"
 
-#: users/models/user.py:457
+#: users/models/user.py:468
 msgid "Administrator is the super user of system"
 msgstr "Administrator是初始的超级管理员"
 
@@ -5323,43 +5358,43 @@ msgstr "您好 %(name)s"
 msgid ""
 "\n"
 "    Hello %(name)s:\n"
-"    </br>\n"
+"    <br>\n"
 "    Please click the link below to reset your password, if not your request, "
 "concern your account security\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(rest_password_url)s?token=%(rest_password_token)s\">Click "
 "here reset password</a>\n"
-"    </br>\n"
+"    <br>\n"
 "    This link is valid for 1 hour. After it expires, <a href="
 "\"%(forget_password_url)s?email=%(email)s\">request new one</a>\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    ---\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(login_url)s\">Login direct</a>\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    "
 msgstr ""
 "\n"
 "    您好 %(name)s:\n"
-"    </br>\n"
+"    <br>\n"
 "    请点击下面链接重置密码， 如果不是您申请的，请关注账号安全\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(rest_password_url)s?token=%(rest_password_token)s\">请点击这"
 "里设置密码 </a>\n"
-"    </br>\n"
+"    <br>\n"
 "    这个链接有效期1小时, 超过时间您可以<a href=\"%(forget_password_url)s?"
 "email=%(email)s\">重新申请</a>\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    ---\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(login_url)s\">直接登录</a>\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    "
 
 #: users/utils.py:117
@@ -5371,77 +5406,103 @@ msgstr "安全通知"
 msgid ""
 "\n"
 "    Hello %(name)s:\n"
-"    </br>\n"
+"    <br>\n"
 "    Your password will expire in %(date_password_expired)s,\n"
-"    </br>\n"
+"    <br>\n"
 "    For your account security, please click on the link below to update your "
 "password in time\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(update_password_url)s\">Click here update password</a>\n"
-"    </br>\n"
+"    <br>\n"
 "    If your password has expired, please click \n"
 "    <a href=\"%(forget_password_url)s?email=%(email)s\">Password expired</"
 "a> \n"
 "    to apply for a password reset email.\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    ---\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(login_url)s\">Login direct</a>\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    "
 msgstr ""
 "\n"
 "    您好 %(name)s:\n"
-"    </br>\n"
+"    <br>\n"
 "    您的密码会在 %(date_password_expired)s 过期，\n"
-"    </br>\n"
+"    <br>\n"
 "    为了您的账号安全，请点击下面的链接及时更新密码\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(update_password_url)s\">请点击这里更新密码</a>\n"
-"    </br>\n"
+"    <br>\n"
 "    如果您的密码已经过期，请点击 \n"
 "    <a href=\"%(forget_password_url)s?email=%(email)s\">密码过期</a> \n"
 "    申请一份重置密码邮件。\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    ---\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(login_url)s\">直接登录</a>\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    "
 
 #: users/utils.py:155
+msgid "Expiration notice"
+msgstr "过期通知"
+
+#: users/utils.py:157
+#, python-format
+msgid ""
+"\n"
+"       Hello %(name)s:\n"
+"       <br>\n"
+"       Your account will expire in %(date_expired)s,\n"
+"       <br>\n"
+"       In order not to affect your normal work, please contact the "
+"administrator for confirmation.\n"
+"       <br>\n"
+"       "
+msgstr ""
+"\n"
+"       您好 %(name)s:\n"
+"       <br>\n"
+"       您的账户会在 %(date_expired)s 过期，\n"
+"       <br>\n"
+"       为了不影响您正常工作，请联系管理员确认。\n"
+"       <br>\n"
+"       "
+
+#: users/utils.py:176
 msgid "SSH Key Reset"
 msgstr "重置ssh密钥"
 
-#: users/utils.py:157
+#: users/utils.py:178
 #, python-format
 msgid ""
 "\n"
 "    Hello %(name)s:\n"
-"    </br>\n"
+"    <br>\n"
 "    Your ssh public key has been reset by site administrator.\n"
 "    Please login and reset your ssh public key.\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(login_url)s\">Login direct</a>\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    "
 msgstr ""
 "\n"
 "    你好 %(name)s:\n"
-"    </br>\n"
+"    <br>\n"
 "    您的密钥已被管理员重置,\n"
 "    请登录并重新设置您的密钥.\n"
-"    </br>\n"
+"    <br>\n"
 "    <a href=\"%(login_url)s\">Login direct</a>\n"
 "\n"
-"    </br>\n"
+"    <br>\n"
 "    "
 
 #: users/views/group.py:29
@@ -5948,6 +6009,8 @@ msgstr "执行次数"
 msgid "Instance count"
 msgstr "实例个数"
 
+# msgid "Sync success"
+# msgstr "同步成功"
 #: xpack/plugins/cloud/views.py:63
 msgid "Update account"
 msgstr "更新账户"
@@ -6191,27 +6254,23 @@ msgstr "密码匣子"
 msgid "vault create"
 msgstr "创建"
 
-#~ msgid "Please select assets that need to be updated"
-#~ msgstr "请选择需要更新的资产"
-
-#~ msgid "The user {} password has expired, please update."
-#~ msgstr "用户 {} 密码已经过期，请更新。"
-
 #~ msgid "User not exist"
 #~ msgstr "用户不存在"
 
+# msgid "Disabled or expired"
+# msgstr "禁用或失效"
 #~ msgid "Password or SSH public key invalid"
 #~ msgstr "密码或密钥不合法"
 
+#~ msgid "Please select assets that need to be updated"
+#~ msgstr "请选择需要更新的资产"
+
 #~ msgid "Interface"
 #~ msgstr "界面"
 
 #~ msgid "Orgs"
 #~ msgstr "组织管理"
 
-#~ msgid "Org"
-#~ msgstr "组织"
-
 #~ msgid "already exists"
 #~ msgstr "已经存在"
 

apps/ops/api/command.py

@@ -4,13 +4,14 @@ from rest_framework import viewsets
 from django.db import transaction
 from django.conf import settings
 
+from orgs.mixins import RootOrgViewMixin
 from common.permissions import IsValidUser
 from ..models import CommandExecution
 from ..serializers import CommandExecutionSerializer
 from ..tasks import run_command_execution
 
 
-class CommandExecutionViewSet(viewsets.ModelViewSet):
+class CommandExecutionViewSet(RootOrgViewMixin, viewsets.ModelViewSet):
     serializer_class = CommandExecutionSerializer
     permission_classes = (IsValidUser,)
 

apps/ops/tasks.py

@@ -109,7 +109,9 @@ def hello(name, callback=None):
 # @after_app_shutdown_clean_periodic
 # @register_as_period_task(interval=30)
 def hello123():
+    p = subprocess.Popen('ls /tmp', shell=True)
     print("{} Hello world".format(datetime.datetime.now().strftime("%H:%M:%S")))
+    return None
 
 
 @shared_task

apps/static/js/jumpserver.js

@@ -608,8 +608,9 @@ jumpserver.initServerSideDataTable = function (options) {
                        var kv = val.split(":");
                        if (kv.length === 2) {
                            var value = kv[1];
-                           value = value.replace("+", " ");
-                           search_attr[kv[0]] = value
+                           var key = kv[0].trim();
+                           value = value.replace("+", " ").trim();
+                           search_attr[key] = value
                        } else {
                            search_raw.push(kv)
                        }

apps/static/plugins/elfinder/i18n/elfinder.zh_CN.js

@@ -422,7 +422,7 @@
 			'minsLeft'        : '剩余 $1 分钟', // from v2.1.17 added 13.11.2016
 			'openAsEncoding'  : '使用所选编码重新打开', // from v2.1.19 added 2.12.2016
 			'saveAsEncoding'  : '使用所选编码保存', // from v2.1.19 added 2.12.2016
-			'selectFolder'    : '选择目录(暂不支持)', // from v2.1.20 added 13.12.2016
+			'selectFolder'    : '选择目录', // from v2.1.20 added 13.12.2016
 			'firstLetterSearch': '首字母搜索', // from v2.1.23 added 24.3.2017
 			'presets'         : '预置', // from v2.1.25 added 26.5.2017
 			'tooManyToTrash'  : '项目太多，不能移动到回收站.', // from v2.1.25 added 9.6.2017

apps/templates/_message.html

 {% load i18n %}
 
+{% block user_expired_message %}
+    {% if request.user.is_expired %}
+        <div class="alert alert-danger help-message alert-dismissable">
+            {% blocktrans %}
+                Your account has expired, please contact the administrator.
+            {% endblocktrans %}
+            <button aria-hidden="true" data-dismiss="alert" class="close" type="button" style="outline: none;">×</button>
+        </div>
+    {% elif request.user.will_expired %}
+        <div class="alert alert-danger help-message alert-dismissable">
+            {% trans 'Your account will at' %} {{ request.user.date_expired }} {% trans 'expired. ' %}
+            <button aria-hidden="true" data-dismiss="alert" class="close" type="button" style="outline: none;">×</button>
+        </div>
+    {% endif %}
+{% endblock %}
+
 {% block password_expired_message %}
     {% url 'users:user-password-update' as user_password_update_url %}
-    {% if request.user.password_has_expired  %}
+    {% if request.user.password_has_expired %}
         <div class="alert alert-danger help-message alert-dismissable">
             {% blocktrans %}
                 Your password has expired, please click <a href="{{ user_password_update_url }}"> this link </a> update password.

apps/terminal/serializers/v1.py

@@ -27,6 +27,7 @@ class TerminalSerializer(serializers.ModelSerializer):
 
 class SessionSerializer(BulkOrgResourceModelSerializer):
     command_amount = serializers.IntegerField(read_only=True)
+    org_id = serializers.CharField(allow_blank=True)
 
     class Meta:
         model = Session

apps/users/models/user.py

@@ -207,20 +207,19 @@ class TokenMixin:
 
     @property
     def private_token(self):
-        from authentication.models import PrivateToken
-        try:
-            token = PrivateToken.objects.get(user=self)
-        except PrivateToken.DoesNotExist:
-            token = self.create_private_token()
-        return token
+        return self.create_private_token()
 
     def create_private_token(self):
         from authentication.models import PrivateToken
-        token = PrivateToken.objects.create(user=self)
+        token, created = PrivateToken.objects.get_or_create(user=self)
         return token
 
+    def delete_private_token(self):
+        from authentication.models import PrivateToken
+        PrivateToken.objects.filter(user=self).delete()
+
     def refresh_private_token(self):
-        self.private_token.delete()
+        self.delete_private_token()
         return self.create_private_token()
 
     def create_bearer_token(self, request=None):
@@ -403,6 +402,18 @@ class User(AuthMixin, TokenMixin, RoleMixin, MFAMixin, AbstractUser):
         else:
             return False
 
+    @property
+    def expired_remain_days(self):
+        date_remain = self.date_expired - timezone.now()
+        return date_remain.days
+
+    @property
+    def will_expired(self):
+        if 0 <= self.expired_remain_days < 5:
+            return True
+        else:
+            return False
+
     @property
     def is_valid(self):
         if self.is_active and not self.is_expired:
@@ -412,7 +423,7 @@ class User(AuthMixin, TokenMixin, RoleMixin, MFAMixin, AbstractUser):
     @property
     def is_local(self):
         return self.source == self.SOURCE_LOCAL
-    
+
     def save(self, *args, **kwargs):
         if not self.name:
             self.name = self.username

apps/users/tasks.py

 # -*- coding: utf-8 -*-
 #
 
-import datetime
-from django.utils import timezone
-from django.conf import settings
 from celery import shared_task
 
 from ops.celery.utils import create_or_update_celery_periodic_tasks
-from ops.celery.decorator import after_app_ready_start, register_as_period_task
+from ops.celery.decorator import after_app_ready_start
 from common.utils import get_logger
 from .models import User
-from .utils import send_password_expiration_reminder_mail
+from .utils import (
+    send_password_expiration_reminder_mail, send_user_expiration_reminder_mail
+)
 
 
 logger = get_logger(__file__)
@@ -43,4 +42,27 @@ def check_password_expired_periodic():
     create_or_update_celery_periodic_tasks(tasks)
 
 
+@shared_task
+def check_user_expired():
+    users = User.objects.exclude(role=User.ROLE_APP)
+    for user in users:
+        if not user.is_valid:
+            continue
+        if not user.will_expired:
+            continue
+        send_user_expiration_reminder_mail(user)
+
+
+@shared_task
+@after_app_ready_start
+def check_user_expired_periodic():
+    tasks = {
+        'check_user_expired_periodic': {
+            'task': check_user_expired.name,
+            'interval': None,
+            'crontab': '0 14 * * *',
+            'enabled': True,
+        }
+    }
+    create_or_update_celery_periodic_tasks(tasks)
 

apps/users/utils.py

@@ -85,20 +85,20 @@ def send_reset_password_mail(user):
     recipient_list = [user.email]
     message = _("""
     Hello %(name)s:
-    </br>
+    <br>
     Please click the link below to reset your password, if not your request, concern your account security
-    </br>
+    <br>
     <a href="%(rest_password_url)s?token=%(rest_password_token)s">Click here reset password</a>
-    </br>
+    <br>
     This link is valid for 1 hour. After it expires, <a href="%(forget_password_url)s?email=%(email)s">request new one</a>
 
-    </br>
+    <br>
     ---
 
-    </br>
+    <br>
     <a href="%(login_url)s">Login direct</a>
 
-    </br>
+    <br>
     """) % {
         'name': user.name,
         'rest_password_url': reverse('users:reset-password', external=True),
@@ -118,24 +118,24 @@ def send_password_expiration_reminder_mail(user):
     recipient_list = [user.email]
     message = _("""
     Hello %(name)s:
-    </br>
+    <br>
     Your password will expire in %(date_password_expired)s,
-    </br>
+    <br>
     For your account security, please click on the link below to update your password in time
-    </br>
+    <br>
     <a href="%(update_password_url)s">Click here update password</a>
-    </br>
+    <br>
     If your password has expired, please click 
     <a href="%(forget_password_url)s?email=%(email)s">Password expired</a> 
     to apply for a password reset email.
 
-    </br>
+    <br>
     ---
 
-    </br>
+    <br>
     <a href="%(login_url)s">Login direct</a>
 
-    </br>
+    <br>
     """) % {
         'name': user.name,
         'date_password_expired': datetime.fromtimestamp(datetime.timestamp(
@@ -151,18 +151,39 @@ def send_password_expiration_reminder_mail(user):
     send_mail_async.delay(subject, message, recipient_list, html_message=message)
 
 
+def send_user_expiration_reminder_mail(user):
+    subject = _('Expiration notice')
+    recipient_list = [user.email]
+    message = _("""
+       Hello %(name)s:
+       <br>
+       Your account will expire in %(date_expired)s,
+       <br>
+       In order not to affect your normal work, please contact the administrator for confirmation.
+       <br>
+       """) % {
+        'name': user.name,
+        'date_expired': datetime.fromtimestamp(datetime.timestamp(
+            user.date_expired)).strftime('%Y-%m-%d %H:%M'),
+    }
+    if settings.DEBUG:
+        logger.debug(message)
+
+    send_mail_async.delay(subject, message, recipient_list, html_message=message)
+
+
 def send_reset_ssh_key_mail(user):
     subject = _('SSH Key Reset')
     recipient_list = [user.email]
     message = _("""
     Hello %(name)s:
-    </br>
+    <br>
     Your ssh public key has been reset by site administrator.
     Please login and reset your ssh public key.
-    </br>
+    <br>
     <a href="%(login_url)s">Login direct</a>
 
-    </br>
+    <br>
     """) % {
         'name': user.name,
         'login_url': reverse('authentication:login', external=True),
@@ -264,6 +285,12 @@ def increase_login_failed_count(username, ip):
     cache.set(key_limit, count, int(limit_time)*60)
 
 
+def get_login_failed_count(username, ip):
+    key_limit = key_prefix_limit.format(username, ip)
+    count = cache.get(key_limit, 0)
+    return count
+
+
 def clean_failed_count(username, ip):
     key_limit = key_prefix_limit.format(username, ip)
     key_block = key_prefix_block.format(username)
@@ -272,9 +299,8 @@ def clean_failed_count(username, ip):
 
 
 def is_block_login(username, ip):
-    key_limit = key_prefix_limit.format(username, ip)
+    count = get_login_failed_count(username, ip)
     key_block = key_prefix_block.format(username)
-    count = cache.get(key_limit, 0)
 
     limit_count = settings.SECURITY_LOGIN_LIMIT_COUNT
     limit_time = settings.SECURITY_LOGIN_LIMIT_TIME