recover yaml driver
This commit is contained in:
Boshi Lian
parent
d67332107f
commit
29a7a231ae
5 changed files with 59 additions and 58 deletions
|
|
@ -24,7 +24,7 @@ services:
|
|||
- "/test.sh"
|
||||
depends_on:
|
||||
- piper
|
||||
# - piper_yaml
|
||||
- piper_yaml
|
||||
# - piper_mysql
|
||||
# - piper_pg
|
||||
# - piper_mssql
|
||||
|
|
@ -49,22 +49,22 @@ services:
|
|||
depends_on:
|
||||
- host1
|
||||
- host2
|
||||
# piper_yaml:
|
||||
# environment:
|
||||
# - "SSHPIPERD_UPSTREAM_DRIVER=yaml"
|
||||
# - "SSHPIPERD_UPSTREAM_YAML_NOCHECKPERM=true"
|
||||
# - "SSHPIPERD_UPSTREAM_YAML_FILE=/sshpiperd.yaml"
|
||||
# - "SSHPIPERD_AUDITOR=typescript-logger"
|
||||
# - "SSHPIPERD_BANNERTEXT=hellopiper"
|
||||
# - "SSHPIPERD_LOG_LEVEL=trace"
|
||||
# build: ../..
|
||||
# volumes:
|
||||
# - localkey:/local
|
||||
# - workingdir:/var/sshpiper
|
||||
# - ./sshpiperd.yaml:/sshpiperd.yaml
|
||||
# depends_on:
|
||||
# - host1
|
||||
# - host2
|
||||
piper_yaml:
|
||||
environment:
|
||||
- "SSHPIPERD_UPSTREAM_DRIVER=yaml"
|
||||
- "SSHPIPERD_UPSTREAM_YAML_NOCHECKPERM=true"
|
||||
- "SSHPIPERD_UPSTREAM_YAML_FILE=/sshpiperd.yaml"
|
||||
- "SSHPIPERD_AUDITOR=typescript-logger"
|
||||
- "SSHPIPERD_BANNERTEXT=hellopiper"
|
||||
- "SSHPIPERD_LOG_LEVEL=trace"
|
||||
build: ../..
|
||||
volumes:
|
||||
- localkey:/local
|
||||
- workingdir:/var/sshpiper
|
||||
- ./sshpiperd.yaml:/sshpiperd.yaml
|
||||
depends_on:
|
||||
- host1
|
||||
- host2
|
||||
# piper_sqlite:
|
||||
# environment:
|
||||
# - "SSHPIPERD_UPSTREAM_DRIVER=sqlite"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
|
||||
/wait.sh piper 2222
|
||||
# /wait.sh piper_yaml 2222
|
||||
/wait.sh piper_yaml 2222
|
||||
#/wait.sh piper_sqlite 2222
|
||||
# /wait.sh piper_mysql 2222
|
||||
# /wait.sh piper_pg 2222
|
||||
|
|
@ -49,10 +49,10 @@ runtest(){
|
|||
|
||||
grep $rnd /workingdir/$user/*
|
||||
|
||||
# if [ $? -ne 0 ];then
|
||||
# echo -e "grep typescript logger" $fail
|
||||
# exit 1
|
||||
# fi
|
||||
if [ $? -ne 0 ];then
|
||||
echo -e "grep typescript logger" $fail
|
||||
exit 1
|
||||
fi
|
||||
|
||||
grep "hellopiper" /tmp/$host.stderr
|
||||
|
||||
|
|
@ -71,14 +71,14 @@ runtest "host2 with password:" "host2" "host2" "sshpass -p root ssh -v host2@pip
|
|||
# runtest "msql host2 with password:" "host2" "host2" "sshpass -p root ssh host2@piper_mssql -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2"
|
||||
|
||||
|
||||
# runtest "yaml host2 with password passthrough:" "host2" "passthrough" "sshpass -p root ssh passthrough@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2"
|
||||
# runtest "yaml host2 with password mappasspass:" "host2" "mappasspass" "sshpass -p pass ssh mappasspass@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2"
|
||||
# runtest "yaml host1 with password mappasskey:" "host1" "mappasskey" "sshpass -p pass ssh mappasskey@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host1"
|
||||
# runtest "yaml host2 with password mapkeypass:" "host2" "mapkeypass" "ssh mapkeypass@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host2"
|
||||
# runtest "yaml host2 with key mapkeykey:" "host1" "mapkeykey" "ssh mapkeykey@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host1"
|
||||
# runtest "yaml host2 with key mapkeykey2:" "host1" "mapkeykey2" "ssh mapkeykey2@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host1"
|
||||
# runtest "yaml host2 with password regex:" "host2" "regex000" "sshpass -p root ssh regex000@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2"
|
||||
# runtest "yaml host1 with none host1:" "host1" "host1" "ssh host1@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host1"
|
||||
runtest "yaml host2 with password passthrough:" "host2" "passthrough" "sshpass -p root ssh passthrough@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2"
|
||||
runtest "yaml host2 with password mappasspass:" "host2" "mappasspass" "sshpass -p pass ssh mappasspass@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2"
|
||||
runtest "yaml host1 with password mappasskey:" "host1" "mappasskey" "sshpass -p pass ssh mappasskey@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host1"
|
||||
runtest "yaml host2 with password mapkeypass:" "host2" "mapkeypass" "ssh mapkeypass@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host2"
|
||||
runtest "yaml host2 with key mapkeykey:" "host1" "mapkeykey" "ssh mapkeykey@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host1"
|
||||
runtest "yaml host2 with key mapkeykey2:" "host1" "mapkeykey2" "ssh mapkeykey2@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host1"
|
||||
runtest "yaml host2 with password regex:" "host2" "regex000" "sshpass -p root ssh regex000@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2"
|
||||
runtest "yaml host1 with none host1:" "host1" "host1" "ssh host1@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host1"
|
||||
|
||||
# runtest "grpc host1 with remotesigner:" "host1" "host1" "ssh host1@piper_grpc_remotesigner_host1 -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PubkeyAuthentication=no -o PasswordAuthentication=no cat /names/host1"
|
||||
# runtest "grpc host1 with privatekey:" "host1" "host1" "ssh host1@piper_grpc_privatekey_host1 -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PubkeyAuthentication=no -o PasswordAuthentication=no cat /names/host1"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ import (
|
|||
// _ "github.com/tg123/sshpiper/sshpiperd/upstream/grpcupstream"
|
||||
// _ "github.com/tg123/sshpiper/sshpiperd/upstream/kubernetes"
|
||||
_ "github.com/tg123/sshpiper/sshpiperd/upstream/workingdir"
|
||||
// _ "github.com/tg123/sshpiper/sshpiperd/upstream/yaml"
|
||||
_ "github.com/tg123/sshpiper/sshpiperd/upstream/yaml"
|
||||
|
||||
// _ "github.com/tg123/sshpiper/sshpiperd/challenger/authy"
|
||||
// _ "github.com/tg123/sshpiper/sshpiperd/challenger/azdevicecode"
|
||||
|
|
|
|||
|
|
@ -123,7 +123,7 @@ func installDrivers(piper *ssh.PiperConfig, config *piperdConfig, logger *log.Lo
|
|||
// return nil
|
||||
// },
|
||||
// },
|
||||
// // auditor driver
|
||||
// auditor driver
|
||||
{
|
||||
"Auditor",
|
||||
config.AuditorDriver,
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ import (
|
|||
"regexp"
|
||||
|
||||
"github.com/tg123/sshpiper/sshpiperd/upstream"
|
||||
"github.com/tg123/sshpiper/sshpiperd/v0bridge"
|
||||
"golang.org/x/crypto/ssh"
|
||||
"golang.org/x/crypto/ssh/knownhosts"
|
||||
"gopkg.in/yaml.v3"
|
||||
|
|
@ -105,7 +106,7 @@ func (p *plugin) loadConfig() (piperConfig, error) {
|
|||
type createPipeCtx struct {
|
||||
pipe pipeConfig
|
||||
conn ssh.ConnMetadata
|
||||
challengeContext ssh.AdditionalChallengeContext
|
||||
challengeContext ssh.ChallengeContext
|
||||
}
|
||||
|
||||
func (p *plugin) loadFileOrDecode(file string, base64data string, ctx createPipeCtx) ([]byte, error) {
|
||||
|
|
@ -136,7 +137,7 @@ func (p *plugin) loadFileOrDecode(file string, base64data string, ctx createPipe
|
|||
return nil, nil
|
||||
}
|
||||
|
||||
func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challengeContext ssh.AdditionalChallengeContext) (*ssh.AuthPipe, error) {
|
||||
func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challengeContext ssh.ChallengeContext) (*v0bridge.AuthPipe, error) {
|
||||
ctx := createPipeCtx{pipe, conn, challengeContext}
|
||||
|
||||
hostKeyCallback := ssh.InsecureIgnoreHostKey()
|
||||
|
|
@ -157,20 +158,20 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
}
|
||||
}
|
||||
|
||||
to := func(key ssh.PublicKey) (ssh.AuthPipeType, ssh.AuthMethod, error) {
|
||||
to := func(key ssh.PublicKey) (v0bridge.AuthPipeType, ssh.AuthMethod, error) {
|
||||
|
||||
switch pipe.Authmap.To.Type {
|
||||
case "none":
|
||||
return ssh.AuthPipeTypeNone, nil, nil
|
||||
return v0bridge.AuthPipeTypeNone, nil, nil
|
||||
|
||||
case "password":
|
||||
return ssh.AuthPipeTypeMap, ssh.Password(pipe.Authmap.To.Password), nil
|
||||
return v0bridge.AuthPipeTypeMap, ssh.Password(pipe.Authmap.To.Password), nil
|
||||
|
||||
case "privatekey":
|
||||
|
||||
privateBytes, err := p.loadFileOrDecode(pipe.Authmap.To.PrivateKey, pipe.Authmap.To.PrivateKeyData, ctx)
|
||||
if err != nil {
|
||||
return ssh.AuthPipeTypeDiscard, nil, err
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, err
|
||||
}
|
||||
|
||||
// did not find to 1 private key try key map
|
||||
|
|
@ -178,7 +179,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
for _, privkey := range pipe.Authmap.To.KeyMap {
|
||||
rest, err := p.loadFileOrDecode(privkey.AuthorizedKeys, privkey.AuthorizedKeysData, ctx)
|
||||
if err != nil {
|
||||
return ssh.AuthPipeTypeDiscard, nil, err
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, err
|
||||
}
|
||||
|
||||
var authedPubkey ssh.PublicKey
|
||||
|
|
@ -186,7 +187,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
for len(rest) > 0 {
|
||||
authedPubkey, _, _, rest, err = ssh.ParseAuthorizedKey(rest)
|
||||
if err != nil {
|
||||
return ssh.AuthPipeTypeDiscard, nil, err
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, err
|
||||
}
|
||||
|
||||
keydata := key.Marshal()
|
||||
|
|
@ -195,7 +196,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
privateBytes, err = p.loadFileOrDecode(privkey.PrivateKey, privkey.PrivateKeyData, ctx)
|
||||
|
||||
if err != nil {
|
||||
return ssh.AuthPipeTypeDiscard, nil, err
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, err
|
||||
}
|
||||
|
||||
if len(privateBytes) > 0 {
|
||||
|
|
@ -209,32 +210,32 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
}
|
||||
|
||||
if len(privateBytes) == 0 {
|
||||
return ssh.AuthPipeTypeDiscard, nil, fmt.Errorf("no private key found")
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, fmt.Errorf("no private key found")
|
||||
}
|
||||
|
||||
private, err := ssh.ParsePrivateKey(privateBytes)
|
||||
if err != nil {
|
||||
return ssh.AuthPipeTypeDiscard, nil, err
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, err
|
||||
}
|
||||
|
||||
return ssh.AuthPipeTypeMap, ssh.PublicKeys(private), nil
|
||||
return v0bridge.AuthPipeTypeMap, ssh.PublicKeys(private), nil
|
||||
|
||||
default:
|
||||
p.logger.Printf("unsupport type [%v] fallback to passthrough", pipe.Authmap.To.Type)
|
||||
}
|
||||
|
||||
if pipe.Authmap.NoPassthrough {
|
||||
return ssh.AuthPipeTypeDiscard, nil, nil
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, nil
|
||||
}
|
||||
|
||||
return ssh.AuthPipeTypePassThrough, nil, nil
|
||||
return v0bridge.AuthPipeTypePassThrough, nil, nil
|
||||
}
|
||||
|
||||
allowPasswords := make(map[string]bool)
|
||||
var allowPubKeys []ssh.PublicKey
|
||||
allowAnyPubKey := false
|
||||
|
||||
a := &ssh.AuthPipe{
|
||||
a := &v0bridge.AuthPipe{
|
||||
User: pipe.Authmap.MappedUsername,
|
||||
|
||||
UpstreamHostKeyCallback: hostKeyCallback,
|
||||
|
|
@ -245,7 +246,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
case "none":
|
||||
|
||||
if a.NoneAuthCallback == nil {
|
||||
a.NoneAuthCallback = func(conn ssh.ConnMetadata) (ssh.AuthPipeType, ssh.AuthMethod, error) {
|
||||
a.NoneAuthCallback = func(conn ssh.ConnMetadata) (v0bridge.AuthPipeType, ssh.AuthMethod, error) {
|
||||
return to(nil)
|
||||
}
|
||||
}
|
||||
|
|
@ -254,7 +255,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
allowPasswords[from.Password] = true
|
||||
|
||||
if a.PasswordCallback == nil {
|
||||
a.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (ssh.AuthPipeType, ssh.AuthMethod, error) {
|
||||
a.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (v0bridge.AuthPipeType, ssh.AuthMethod, error) {
|
||||
|
||||
_, ok := allowPasswords[string(password)]
|
||||
|
||||
|
|
@ -263,10 +264,10 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
}
|
||||
|
||||
if pipe.Authmap.NoPassthrough {
|
||||
return ssh.AuthPipeTypeDiscard, nil, nil
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, nil
|
||||
}
|
||||
|
||||
return ssh.AuthPipeTypePassThrough, nil, nil
|
||||
return v0bridge.AuthPipeTypePassThrough, nil, nil
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -294,7 +295,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
}
|
||||
|
||||
if a.PublicKeyCallback == nil {
|
||||
a.PublicKeyCallback = func(conn ssh.ConnMetadata, key ssh.PublicKey) (ssh.AuthPipeType, ssh.AuthMethod, error) {
|
||||
a.PublicKeyCallback = func(conn ssh.ConnMetadata, key ssh.PublicKey) (v0bridge.AuthPipeType, ssh.AuthMethod, error) {
|
||||
|
||||
if allowAnyPubKey {
|
||||
return to(key)
|
||||
|
|
@ -309,24 +310,24 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
}
|
||||
|
||||
if pipe.Authmap.NoPassthrough {
|
||||
return ssh.AuthPipeTypeDiscard, nil, nil
|
||||
return v0bridge.AuthPipeTypeDiscard, nil, nil
|
||||
}
|
||||
|
||||
// will fail but discard will lead a timeout
|
||||
return ssh.AuthPipeTypePassThrough, nil, nil
|
||||
return v0bridge.AuthPipeTypePassThrough, nil, nil
|
||||
}
|
||||
}
|
||||
|
||||
case "any":
|
||||
a.NoneAuthCallback = func(conn ssh.ConnMetadata) (ssh.AuthPipeType, ssh.AuthMethod, error) {
|
||||
a.NoneAuthCallback = func(conn ssh.ConnMetadata) (v0bridge.AuthPipeType, ssh.AuthMethod, error) {
|
||||
return to(nil)
|
||||
}
|
||||
|
||||
a.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (ssh.AuthPipeType, ssh.AuthMethod, error) {
|
||||
a.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (v0bridge.AuthPipeType, ssh.AuthMethod, error) {
|
||||
return to(nil)
|
||||
}
|
||||
|
||||
a.PublicKeyCallback = func(conn ssh.ConnMetadata, key ssh.PublicKey) (ssh.AuthPipeType, ssh.AuthMethod, error) {
|
||||
a.PublicKeyCallback = func(conn ssh.ConnMetadata, key ssh.PublicKey) (v0bridge.AuthPipeType, ssh.AuthMethod, error) {
|
||||
return to(key)
|
||||
}
|
||||
|
||||
|
|
@ -341,7 +342,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng
|
|||
return a, nil
|
||||
}
|
||||
|
||||
func (p *plugin) findUpstream(conn ssh.ConnMetadata, challengeContext ssh.AdditionalChallengeContext) (net.Conn, *ssh.AuthPipe, error) {
|
||||
func (p *plugin) findUpstream(conn ssh.ConnMetadata, challengeContext ssh.ChallengeContext) (net.Conn, *v0bridge.AuthPipe, error) {
|
||||
user := conn.User()
|
||||
|
||||
config, err := p.loadConfig()
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue