From fe3e68afd99d8ea246be52893730f987e138ec24 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sun, 19 Sep 2021 13:22:59 +0300 Subject: move args to config package logger package rewrite as dlog --- internal/ssh/server/hostkey.go | 17 +++++++++-------- internal/ssh/server/publickeycallback.go | 12 ++++++------ 2 files changed, 15 insertions(+), 14 deletions(-) (limited to 'internal/ssh/server') diff --git a/internal/ssh/server/hostkey.go b/internal/ssh/server/hostkey.go index 07790ad..20de1f0 100644 --- a/internal/ssh/server/hostkey.go +++ b/internal/ssh/server/hostkey.go @@ -1,11 +1,12 @@ package server import ( - "github.com/mimecast/dtail/internal/config" - "github.com/mimecast/dtail/internal/io/logger" - "github.com/mimecast/dtail/internal/ssh" "io/ioutil" "os" + + "github.com/mimecast/dtail/internal/config" + "github.com/mimecast/dtail/internal/io/dlog" + "github.com/mimecast/dtail/internal/ssh" ) // PrivateHostKey retrieves the private server RSA host key. @@ -14,24 +15,24 @@ func PrivateHostKey() []byte { _, err := os.Stat(hostKeyFile) if os.IsNotExist(err) { - logger.Info("Generating private server RSA host key") + dlog.Common.Info("Generating private server RSA host key") privateKey, err := ssh.GeneratePrivateRSAKey(config.Server.HostKeyBits) if err != nil { - logger.FatalExit("Failed to generate private server RSA host key", err) + dlog.Common.FatalPanic("Failed to generate private server RSA host key", err) } pem := ssh.EncodePrivateKeyToPEM(privateKey) if err := ioutil.WriteFile(hostKeyFile, pem, 0600); err != nil { - logger.Error("Unable to write private server RSA host key to file", hostKeyFile, err) + dlog.Common.Error("Unable to write private server RSA host key to file", hostKeyFile, err) } return pem } - logger.Info("Reading private server RSA host key from file", hostKeyFile) + dlog.Common.Info("Reading private server RSA host key from file", hostKeyFile) pem, err := ioutil.ReadFile(hostKeyFile) if err != nil { - logger.FatalExit("Failed to load private server RSA host key", err) + dlog.Common.FatalPanic("Failed to load private server RSA host key", err) } return pem } diff --git a/internal/ssh/server/publickeycallback.go b/internal/ssh/server/publickeycallback.go index e81f019..65ecdd1 100644 --- a/internal/ssh/server/publickeycallback.go +++ b/internal/ssh/server/publickeycallback.go @@ -7,7 +7,7 @@ import ( osUser "os/user" "github.com/mimecast/dtail/internal/config" - "github.com/mimecast/dtail/internal/io/logger" + "github.com/mimecast/dtail/internal/io/dlog" user "github.com/mimecast/dtail/internal/user/server" gossh "golang.org/x/crypto/ssh" @@ -16,7 +16,7 @@ import ( // PublicKeyCallback is for the server to check whether a public SSH key is authorized ot not. func PublicKeyCallback(c gossh.ConnMetadata, offeredPubKey gossh.PublicKey) (*gossh.Permissions, error) { user := user.New(c.User(), c.RemoteAddr().String()) - logger.Info(user, "Incoming authorization") + dlog.Common.Info(user, "Incoming authorization") cwd, err := os.Getwd() if err != nil { @@ -24,7 +24,7 @@ func PublicKeyCallback(c gossh.ConnMetadata, offeredPubKey gossh.PublicKey) (*go } if config.ServerRelaxedAuthEnable { - logger.Fatal(user, "Granting permissions via relaxed-auth") + dlog.Common.Fatal(user, "Granting permissions via relaxed-auth") return nil, nil } @@ -38,7 +38,7 @@ func PublicKeyCallback(c gossh.ConnMetadata, offeredPubKey gossh.PublicKey) (*go authorizedKeysFile = user.HomeDir + "/.ssh/authorized_keys" } - logger.Info(user, "Reading", authorizedKeysFile) + dlog.Common.Info(user, "Reading", authorizedKeysFile) authorizedKeysBytes, err := ioutil.ReadFile(authorizedKeysFile) if err != nil { return nil, fmt.Errorf("Unable to read authorized keys file|%s|%s|%s", authorizedKeysFile, user, err.Error()) @@ -53,10 +53,10 @@ func PublicKeyCallback(c gossh.ConnMetadata, offeredPubKey gossh.PublicKey) (*go authorizedKeysMap[string(authorizedPubKey.Marshal())] = true authorizedKeysBytes = restBytes - logger.Debug(user, "Authorized public key fingerprint", gossh.FingerprintSHA256(authorizedPubKey)) + dlog.Common.Debug(user, "Authorized public key fingerprint", gossh.FingerprintSHA256(authorizedPubKey)) } - logger.Debug(user, "Offered public key fingerprint", gossh.FingerprintSHA256(offeredPubKey)) + dlog.Common.Debug(user, "Offered public key fingerprint", gossh.FingerprintSHA256(offeredPubKey)) if authorizedKeysMap[string(offeredPubKey.Marshal())] { return &gossh.Permissions{ -- cgit v1.2.3 From fcaa94c7453efa0d74e330128c0f5c2cde8f11b3 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sun, 26 Sep 2021 16:42:47 +0300 Subject: refactor config reader - also looks in additional search paths for config file unless NONE is specified --- internal/ssh/server/publickeycallback.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'internal/ssh/server') diff --git a/internal/ssh/server/publickeycallback.go b/internal/ssh/server/publickeycallback.go index 65ecdd1..59d1f31 100644 --- a/internal/ssh/server/publickeycallback.go +++ b/internal/ssh/server/publickeycallback.go @@ -15,7 +15,10 @@ import ( // PublicKeyCallback is for the server to check whether a public SSH key is authorized ot not. func PublicKeyCallback(c gossh.ConnMetadata, offeredPubKey gossh.PublicKey) (*gossh.Permissions, error) { - user := user.New(c.User(), c.RemoteAddr().String()) + user, err := user.New(c.User(), c.RemoteAddr().String()) + if err != nil { + return nil, err + } dlog.Common.Info(user, "Incoming authorization") cwd, err := os.Getwd() -- cgit v1.2.3 From 97747ea0f3178f7f5890512d483fdccaa82846b0 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 9 Oct 2021 21:10:29 +0300 Subject: vetting and linting and some code restyling --- internal/ssh/server/hostkey.go | 3 ++- internal/ssh/server/publickeycallback.go | 27 ++++++++++++++++----------- 2 files changed, 18 insertions(+), 12 deletions(-) (limited to 'internal/ssh/server') diff --git a/internal/ssh/server/hostkey.go b/internal/ssh/server/hostkey.go index 20de1f0..33bd4e8 100644 --- a/internal/ssh/server/hostkey.go +++ b/internal/ssh/server/hostkey.go @@ -24,7 +24,8 @@ func PrivateHostKey() []byte { pem := ssh.EncodePrivateKeyToPEM(privateKey) if err := ioutil.WriteFile(hostKeyFile, pem, 0600); err != nil { - dlog.Common.Error("Unable to write private server RSA host key to file", hostKeyFile, err) + dlog.Common.Error("Unable to write private server RSA host key to file", + hostKeyFile, err) } return pem } diff --git a/internal/ssh/server/publickeycallback.go b/internal/ssh/server/publickeycallback.go index 59d1f31..ebc428a 100644 --- a/internal/ssh/server/publickeycallback.go +++ b/internal/ssh/server/publickeycallback.go @@ -13,25 +13,28 @@ import ( gossh "golang.org/x/crypto/ssh" ) -// PublicKeyCallback is for the server to check whether a public SSH key is authorized ot not. -func PublicKeyCallback(c gossh.ConnMetadata, offeredPubKey gossh.PublicKey) (*gossh.Permissions, error) { +// PublicKeyCallback is for the server to check whether a public SSH key is +// authorized ot not. +func PublicKeyCallback(c gossh.ConnMetadata, + offeredPubKey gossh.PublicKey) (*gossh.Permissions, error) { + user, err := user.New(c.User(), c.RemoteAddr().String()) if err != nil { return nil, err } - dlog.Common.Info(user, "Incoming authorization") + dlog.Common.Info(user, "Incoming authorization") cwd, err := os.Getwd() if err != nil { return nil, fmt.Errorf("Unable to get current working directory|%s|", err.Error()) } - if config.ServerRelaxedAuthEnable { dlog.Common.Fatal(user, "Granting permissions via relaxed-auth") return nil, nil } - authorizedKeysFile := fmt.Sprintf("%s/%s/%s.authorized_keys", cwd, config.Common.CacheDir, user.Name) + authorizedKeysFile := fmt.Sprintf("%s/%s/%s.authorized_keys", cwd, + config.Common.CacheDir, user.Name) if _, err := os.Stat(authorizedKeysFile); os.IsNotExist(err) { user, err := osUser.Lookup(user.Name) if err != nil { @@ -44,23 +47,25 @@ func PublicKeyCallback(c gossh.ConnMetadata, offeredPubKey gossh.PublicKey) (*go dlog.Common.Info(user, "Reading", authorizedKeysFile) authorizedKeysBytes, err := ioutil.ReadFile(authorizedKeysFile) if err != nil { - return nil, fmt.Errorf("Unable to read authorized keys file|%s|%s|%s", authorizedKeysFile, user, err.Error()) + return nil, fmt.Errorf("Unable to read authorized keys file|%s|%s|%s", + authorizedKeysFile, user, err.Error()) } authorizedKeysMap := map[string]bool{} for len(authorizedKeysBytes) > 0 { authorizedPubKey, _, _, restBytes, err := gossh.ParseAuthorizedKey(authorizedKeysBytes) if err != nil { - return nil, fmt.Errorf("Unable to parse authorized keys bytes|%s|%s", user, err.Error()) + return nil, fmt.Errorf("Unable to parse authorized keys bytes|%s|%s", + user, err.Error()) } authorizedKeysMap[string(authorizedPubKey.Marshal())] = true authorizedKeysBytes = restBytes - - dlog.Common.Debug(user, "Authorized public key fingerprint", gossh.FingerprintSHA256(authorizedPubKey)) + dlog.Common.Debug(user, "Authorized public key fingerprint", + gossh.FingerprintSHA256(authorizedPubKey)) } - dlog.Common.Debug(user, "Offered public key fingerprint", gossh.FingerprintSHA256(offeredPubKey)) - + dlog.Common.Debug(user, "Offered public key fingerprint", + gossh.FingerprintSHA256(offeredPubKey)) if authorizedKeysMap[string(offeredPubKey.Marshal())] { return &gossh.Permissions{ Extensions: map[string]string{ -- cgit v1.2.3 From d556c13d430f291b615d538c35ebdaf9b53aa15d Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 29 Oct 2021 07:50:36 +0300 Subject: Dont use relaxed SSH Auth mode anymore for integration tests --- internal/ssh/server/publickeycallback.go | 66 ++++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 21 deletions(-) (limited to 'internal/ssh/server') diff --git a/internal/ssh/server/publickeycallback.go b/internal/ssh/server/publickeycallback.go index ebc428a..585469f 100644 --- a/internal/ssh/server/publickeycallback.go +++ b/internal/ssh/server/publickeycallback.go @@ -4,7 +4,7 @@ import ( "fmt" "io/ioutil" "os" - osUser "os/user" + goUser "os/user" "github.com/mimecast/dtail/internal/config" "github.com/mimecast/dtail/internal/io/dlog" @@ -24,24 +24,14 @@ func PublicKeyCallback(c gossh.ConnMetadata, } dlog.Common.Info(user, "Incoming authorization") - cwd, err := os.Getwd() - if err != nil { - return nil, fmt.Errorf("Unable to get current working directory|%s|", err.Error()) - } if config.ServerRelaxedAuthEnable { dlog.Common.Fatal(user, "Granting permissions via relaxed-auth") return nil, nil } - authorizedKeysFile := fmt.Sprintf("%s/%s/%s.authorized_keys", cwd, - config.Common.CacheDir, user.Name) - if _, err := os.Stat(authorizedKeysFile); os.IsNotExist(err) { - user, err := osUser.Lookup(user.Name) - if err != nil { - return nil, fmt.Errorf("Unable to authorize|%s|%s|", user, err.Error()) - } - // Fallback to ~ - authorizedKeysFile = user.HomeDir + "/.ssh/authorized_keys" + authorizedKeysFile, err := authorizedKeysFile(user) + if err != nil { + return nil, err } dlog.Common.Info(user, "Reading", authorizedKeysFile) @@ -51,11 +41,17 @@ func PublicKeyCallback(c gossh.ConnMetadata, authorizedKeysFile, user, err.Error()) } + return verifyAuthorizedKeys(user, authorizedKeysBytes, offeredPubKey) +} + +func verifyAuthorizedKeys(user *user.User, authorizedKeysBytes []byte, + offeredPubKey gossh.PublicKey) (*gossh.Permissions, error) { + authorizedKeysMap := map[string]bool{} for len(authorizedKeysBytes) > 0 { authorizedPubKey, _, _, restBytes, err := gossh.ParseAuthorizedKey(authorizedKeysBytes) if err != nil { - return nil, fmt.Errorf("Unable to parse authorized keys bytes|%s|%s", + return nil, fmt.Errorf("unable to parse authorized keys bytes|%s|%s", user, err.Error()) } authorizedKeysMap[string(authorizedPubKey.Marshal())] = true @@ -64,15 +60,43 @@ func PublicKeyCallback(c gossh.ConnMetadata, gossh.FingerprintSHA256(authorizedPubKey)) } - dlog.Common.Debug(user, "Offered public key fingerprint", - gossh.FingerprintSHA256(offeredPubKey)) + dlog.Common.Debug(user, "Offered public key fingerprint", gossh.FingerprintSHA256(offeredPubKey)) if authorizedKeysMap[string(offeredPubKey.Marshal())] { return &gossh.Permissions{ - Extensions: map[string]string{ - "pubkey-fp": gossh.FingerprintSHA256(offeredPubKey), - }, + Extensions: map[string]string{"pubkey-fp": gossh.FingerprintSHA256(offeredPubKey)}, }, nil } - return nil, fmt.Errorf("%s|Public key of user not authorized", user) + return nil, fmt.Errorf("%s|public key of user not authorized", user) +} + +func authorizedKeysFile(user *user.User) (string, error) { + if config.Env("DTAIL_INTEGRATION_TEST_RUN_MODE") { + // In this case, we expect a pub key in the current directory. + return "./id_rsa.pub", nil + } + + cwd, err := os.Getwd() + if err != nil { + return "", err + } + + // Check for cached version in the dserver directory. + authorizedKeysFile := fmt.Sprintf("%s/%s/%s.authorized_keys", cwd, + config.Common.CacheDir, user.Name) + if _, err = os.Stat(authorizedKeysFile); err == nil { + return authorizedKeysFile, nil + } + + // As the last option, check the regular SSH path. + osUser, err := goUser.Lookup(user.Name) + if err != nil { + return "", err + } + authorizedKeysFile = fmt.Sprintf("%s/.ssh/authorized_keys", osUser.HomeDir) + if _, err = os.Stat(authorizedKeysFile); err == nil { + return authorizedKeysFile, nil + } + + return "", fmt.Errorf("unable to find a any authorized keys file") } -- cgit v1.2.3 From 771a1b9712d9906be86578abb6eff8924d490e52 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 29 Oct 2021 08:22:17 +0300 Subject: refactor integration test ssh_host_key configuration --- internal/ssh/server/hostkey.go | 3 +++ 1 file changed, 3 insertions(+) (limited to 'internal/ssh/server') diff --git a/internal/ssh/server/hostkey.go b/internal/ssh/server/hostkey.go index 33bd4e8..4844d36 100644 --- a/internal/ssh/server/hostkey.go +++ b/internal/ssh/server/hostkey.go @@ -12,6 +12,9 @@ import ( // PrivateHostKey retrieves the private server RSA host key. func PrivateHostKey() []byte { hostKeyFile := config.Server.HostKeyFile + if config.Env("DTAIL_INTEGRATION_TEST_RUN_MODE") { + hostKeyFile = "./ssh_host_key" + } _, err := os.Stat(hostKeyFile) if os.IsNotExist(err) { -- cgit v1.2.3 From ffa39a17f48ee9847cc85819d8134b5eb9482b77 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 29 Oct 2021 08:31:26 +0300 Subject: explicitly use dlog.Server for server packages and dlog.Clent for client packages for logging --- internal/ssh/server/hostkey.go | 10 +++++----- internal/ssh/server/publickeycallback.go | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) (limited to 'internal/ssh/server') diff --git a/internal/ssh/server/hostkey.go b/internal/ssh/server/hostkey.go index 4844d36..be23d85 100644 --- a/internal/ssh/server/hostkey.go +++ b/internal/ssh/server/hostkey.go @@ -18,25 +18,25 @@ func PrivateHostKey() []byte { _, err := os.Stat(hostKeyFile) if os.IsNotExist(err) { - dlog.Common.Info("Generating private server RSA host key") + dlog.Server.Info("Generating private server RSA host key") privateKey, err := ssh.GeneratePrivateRSAKey(config.Server.HostKeyBits) if err != nil { - dlog.Common.FatalPanic("Failed to generate private server RSA host key", err) + dlog.Server.FatalPanic("Failed to generate private server RSA host key", err) } pem := ssh.EncodePrivateKeyToPEM(privateKey) if err := ioutil.WriteFile(hostKeyFile, pem, 0600); err != nil { - dlog.Common.Error("Unable to write private server RSA host key to file", + dlog.Server.Error("Unable to write private server RSA host key to file", hostKeyFile, err) } return pem } - dlog.Common.Info("Reading private server RSA host key from file", hostKeyFile) + dlog.Server.Info("Reading private server RSA host key from file", hostKeyFile) pem, err := ioutil.ReadFile(hostKeyFile) if err != nil { - dlog.Common.FatalPanic("Failed to load private server RSA host key", err) + dlog.Server.FatalPanic("Failed to load private server RSA host key", err) } return pem } diff --git a/internal/ssh/server/publickeycallback.go b/internal/ssh/server/publickeycallback.go index 585469f..c661419 100644 --- a/internal/ssh/server/publickeycallback.go +++ b/internal/ssh/server/publickeycallback.go @@ -23,9 +23,9 @@ func PublicKeyCallback(c gossh.ConnMetadata, return nil, err } - dlog.Common.Info(user, "Incoming authorization") + dlog.Server.Info(user, "Incoming authorization") if config.ServerRelaxedAuthEnable { - dlog.Common.Fatal(user, "Granting permissions via relaxed-auth") + dlog.Server.Fatal(user, "Granting permissions via relaxed-auth") return nil, nil } @@ -34,7 +34,7 @@ func PublicKeyCallback(c gossh.ConnMetadata, return nil, err } - dlog.Common.Info(user, "Reading", authorizedKeysFile) + dlog.Server.Info(user, "Reading", authorizedKeysFile) authorizedKeysBytes, err := ioutil.ReadFile(authorizedKeysFile) if err != nil { return nil, fmt.Errorf("Unable to read authorized keys file|%s|%s|%s", @@ -56,11 +56,11 @@ func verifyAuthorizedKeys(user *user.User, authorizedKeysBytes []byte, } authorizedKeysMap[string(authorizedPubKey.Marshal())] = true authorizedKeysBytes = restBytes - dlog.Common.Debug(user, "Authorized public key fingerprint", + dlog.Server.Debug(user, "Authorized public key fingerprint", gossh.FingerprintSHA256(authorizedPubKey)) } - dlog.Common.Debug(user, "Offered public key fingerprint", gossh.FingerprintSHA256(offeredPubKey)) + dlog.Server.Debug(user, "Offered public key fingerprint", gossh.FingerprintSHA256(offeredPubKey)) if authorizedKeysMap[string(offeredPubKey.Marshal())] { return &gossh.Permissions{ Extensions: map[string]string{"pubkey-fp": gossh.FingerprintSHA256(offeredPubKey)}, -- cgit v1.2.3 From c8c42aa26861e28e6f22458fffd8db6d9b712d70 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 6 Nov 2021 12:33:19 +0200 Subject: Remove insecure and dangerous relaxed auth mode --- internal/ssh/server/publickeycallback.go | 5 ----- 1 file changed, 5 deletions(-) (limited to 'internal/ssh/server') diff --git a/internal/ssh/server/publickeycallback.go b/internal/ssh/server/publickeycallback.go index c661419..f7655b4 100644 --- a/internal/ssh/server/publickeycallback.go +++ b/internal/ssh/server/publickeycallback.go @@ -22,12 +22,7 @@ func PublicKeyCallback(c gossh.ConnMetadata, if err != nil { return nil, err } - dlog.Server.Info(user, "Incoming authorization") - if config.ServerRelaxedAuthEnable { - dlog.Server.Fatal(user, "Granting permissions via relaxed-auth") - return nil, nil - } authorizedKeysFile, err := authorizedKeysFile(user) if err != nil { -- cgit v1.2.3