engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Issue #5536 - ability to disable server-side SSH key generation

Browse source 
- Fixes #5536
This commit is contained in:
csalgau 2019-02-14 01:16:57 +02:00
parent 9c532486a2
commit ef7b0fcbd5
11 changed files with 62 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

4
configs/development.ini
View file

@ -631,6 +631,10 @@ ssh.executable.hg = ~/.rccontrol/vcsserver-1/profile/bin/hg
ssh.executable.git = ~/.rccontrol/vcsserver-1/profile/bin/git
ssh.executable.svn = ~/.rccontrol/vcsserver-1/profile/bin/svnserve
## Enables SSH key generator web interface. Disabling this still allows users
## to add their own keys.
ssh.enable_ui_key_generator = true
## Dummy marker to add new entries after.
## Add any custom entries below. Please don't remove.

4
configs/production.ini
View file

@ -604,6 +604,10 @@ ssh.executable.hg = ~/.rccontrol/vcsserver-1/profile/bin/hg
ssh.executable.git = ~/.rccontrol/vcsserver-1/profile/bin/git
ssh.executable.svn = ~/.rccontrol/vcsserver-1/profile/bin/svnserve
## Enables SSH key generator web interface. Disabling this still allows users
## to add their own keys.
ssh.enable_ui_key_generator = true
## Dummy marker to add new entries after.
## Add any custom entries below. Please don't remove.

4
docs/auth/ssh-connection.rst
View file

@ -73,6 +73,10 @@ following instructions.
ssh.executable.git = ~/.rccontrol/vcsserver-1/profile/bin/git
ssh.executable.svn = ~/.rccontrol/vcsserver-1/profile/bin/svnserve
## Enables SSH key generator web interface. Disabling this still allows users
## to add their own keys.
ssh.enable_ui_key_generator = true
3. Set base_url for instance to enable proper event handling (Optional):

9
rhodecode/apps/my_account/views/my_account_ssh_keys.py
View file

@ -71,10 +71,11 @@ class MyAccountSshKeysView(BaseAppView, DataGridAppView):
c = self.load_default_context()
c.active = 'ssh_keys_generate'
comment = 'RhodeCode-SSH {}'.format(c.user.email or '')
c.private, c.public = SshKeyModel().generate_keypair(comment=comment)
c.target_form_url = h.route_path(
'my_account_ssh_keys', _query=dict(default_key=c.public))
if c.ssh_key_generator_enabled:
comment = 'RhodeCode-SSH {}'.format(c.user.email or '')
c.private, c.public = SshKeyModel().generate_keypair(comment=comment)
c.target_form_url = h.route_path(
'my_account_ssh_keys', _query=dict(default_key=c.public))
return self._get_template_context(c)
@LoginRequired()

1
rhodecode/apps/ssh_support/__init__.py
View file

@ -36,6 +36,7 @@ def _sanitize_settings_and_apply_defaults(settings):
_bool_setting(settings, config_keys.generate_authorized_keyfile, 'false')
_bool_setting(settings, config_keys.wrapper_allow_shell, 'false')
_bool_setting(settings, config_keys.enable_debug_logging, 'false')
_bool_setting(settings, config_keys.ssh_key_generator_enabled, 'true')
_string_setting(settings, config_keys.authorized_keys_file_path,
'~/.ssh/authorized_keys_rhodecode',

1
rhodecode/apps/ssh_support/config_keys.py
View file

@ -24,6 +24,7 @@
generate_authorized_keyfile = 'ssh.generate_authorized_keyfile'
authorized_keys_file_path = 'ssh.authorized_keys_file_path'
authorized_keys_line_ssh_opts = 'ssh.authorized_keys_ssh_opts'
ssh_key_generator_enabled = 'ssh.enable_ui_key_generator'
wrapper_cmd = 'ssh.wrapper_cmd'
wrapper_allow_shell = 'ssh.wrapper_cmd_allow_shell'
enable_debug_logging = 'ssh.enable_debug_logging'

2
rhodecode/lib/base.py
View file

@ -348,6 +348,8 @@ def attach_context_attributes(context, request, user_id=None):
config.get('labs_settings_active', 'false'))
context.ssh_enabled = str2bool(
config.get('ssh.generate_authorized_keyfile', 'false'))
context.ssh_key_generator_enabled = str2bool(
config.get('ssh.enable_ui_key_generator', 'true'))
context.visual.allow_repo_location_change = str2bool(
config.get('allow_repo_location_change', True))

6
rhodecode/templates/admin/my_account/my_account_ssh_keys.mako
View file

@ -55,7 +55,9 @@
</div>
<div class="input">
${h.text('description', class_='medium', placeholder=_('Description'))}
<a href="${h.route_path('my_account_ssh_keys_generate')}">${_('Generate random RSA key')}</a>
% if c.ssh_key_generator_enabled:
<a href="${h.route_path('my_account_ssh_keys_generate')}">${_('Generate random RSA key')}</a>
% endif
</div>
</div>
@ -70,7 +72,7 @@
${h.reset('reset',_('Reset'),class_="btn")}
</div>
% if c.default_key:
${_('Click add to use this generate SSH key')}
${_('Click add to use this generated SSH key')}
% endif
</div>
</div>

4
rhodecode/templates/admin/users/user_edit_ssh_keys.mako
View file

@ -50,7 +50,9 @@
</div>
<div class="input">
${h.text('description', class_='medium', placeholder=_('Description'))}
<a href="${h.route_path('edit_user_ssh_keys_generate_keypair', user_id=c.user.user_id)}">${_('Generate random RSA key')}</a>
% if c.ssh_key_generator_enabled:
<a href="${h.route_path('edit_user_ssh_keys_generate_keypair', user_id=c.user.user_id)}">${_('Generate random RSA key')}</a>
% endif
</div>
</div>

54
rhodecode/templates/admin/users/user_edit_ssh_keys_generate.mako
View file

@ -1,14 +1,15 @@
<div class="panel panel-default">
<div class="panel-heading">
<h3 class="panel-title">${_('New SSH Key generated')}</h3>
<h3 class="panel-title">${_('New SSH Key generation')}</h3>
</div>
<div class="panel-body">
<p>
${_('Below is a 2048 bit generated SSH RSA key.')}<br/>
${_('If You wish to use it to access RhodeCode via the SSH please save the private key and click `Use this generated key` at the bottom.')}
</p>
<h4>${_('Private key')}</h4>
<pre>
%if c.ssh_enabled and c.ssh_key_generator_enabled:
<p>
${_('Below is a 2048 bit generated SSH RSA key.')}<br/>
${_('If You wish to use it to access RhodeCode via the SSH please save the private key and click `Use this generated key` at the bottom.')}
</p>
<h4>${_('Private key')}</h4>
<pre>
# Save the below content as
# Windows: /Users/{username}/.ssh/id_rsa_rhodecode_access_priv.key
# macOS: /Users/{yourname}/.ssh/id_rsa_rhodecode_access_priv.key
@ -16,30 +17,35 @@
# Change permissions to 0600 to make it secure, and usable.
e.g chmod 0600 /home/{username}/.ssh/id_rsa_rhodecode_access_priv.key
</pre>
</pre>
<div>
<textarea style="height: 300px">${c.private}</textarea>
</div>
<br/>
<div>
<textarea style="height: 300px">${c.private}</textarea>
</div>
<br/>
<h4>${_('Public key')}</h4>
<pre>
<h4>${_('Public key')}</h4>
<pre>
# Save the below content as
# Windows: /Users/{username}/.ssh/id_rsa_rhodecode_access_pub.key
# macOS: /Users/{yourname}/.ssh/id_rsa_rhodecode_access_pub.key
# Linux: /home/{username}/.ssh/id_rsa_rhodecode_access_pub.key
</pre>
</pre>
<input type="text" value="${c.public}" class="large text" size="100"/>
<p>
% if hasattr(c, 'target_form_url'):
<a href="${c.target_form_url}">${_('Use this generated key')}.</a>
% else:
<a href="${h.route_path('edit_user_ssh_keys', user_id=c.user.user_id, _query=dict(default_key=c.public))}">${_('Use this generated key')}.</a>
% endif
${_('Confirmation required on the next screen')}.
</p>
<input type="text" value="${c.public}" class="large text" size="100"/>
<p>
% if hasattr(c, 'target_form_url'):
<a href="${c.target_form_url}">${_('Use this generated key')}.</a>
% else:
<a href="${h.route_path('edit_user_ssh_keys', user_id=c.user.user_id, _query=dict(default_key=c.public))}">${_('Use this generated key')}.</a>
% endif
${_('Confirmation required on the next screen')}.
</p>
% else:
<h2>
${_('SSH key generator has been disabled.')}
</h2>
% endif
</div>
</div>

4
rhodecode/tests/rhodecode.ini
View file

@ -572,6 +572,10 @@ ssh.executable.hg = ~/.rccontrol/vcsserver-1/profile/bin/hg
ssh.executable.git = ~/.rccontrol/vcsserver-1/profile/bin/git
ssh.executable.svn = ~/.rccontrol/vcsserver-1/profile/bin/svnserve
## Enables SSH key generator web interface. Disabling this still allows users
## to add their own keys.
ssh.enable_ui_key_generator = true
## Dummy marker to add new entries after.
## Add any custom entries below. Please don't remove.