Skip to content

Commit cf405ba

Browse files
speed47speed47
committed
feat: add 2 configurable knobs to (self|account)AddPersonalAccess
widest_v4_prefix (maximum allowed prefix to add in a single ACL), and self_remote_user_only (only allow ACLs where the remote user is the same than the bastion account name)
1 parent 482eddb commit cf405ba

File tree

4 files changed

+130
-17
lines changed

4 files changed

+130
-17
lines changed

‎bin/helper/osh-accountModifyPersonalAccess

+30-10
Original file line numberDiff line numberDiff line change
@@ -85,18 +85,38 @@ my $machine = $ip;
8585
$port and $machine .= ":$port";
8686
$user and $machine = $user . '@' . $machine;
8787

88+
my $plugin = ($target eq 'self' ? 'self' : 'account') . 'AddPersonalAccess';
89+
90+
# check plugin config for (self|account)AddPersonalAccess
91+
my $widestV4Prefix;
92+
if ($action eq 'add') {
93+
$fnret = OVH::Bastion::plugin_config(plugin => $plugin);
94+
$fnret or HEXIT($fnret);
95+
96+
if ($fnret->value && $fnret->value->{'self_remote_user_only'}) {
97+
if (!$user || $user ne $account) {
98+
HEXIT('ERR_INVALID_PARAMETER',
99+
msg => "This bastion policy forces the remote user of personal accesses to match\n"
100+
. "the account name: you may retry with --user $account");
101+
}
102+
}
103+
104+
$widestV4Prefix = $fnret->value->{'widest_v4_prefix'};
105+
}
106+
88107
# access_modify validates all its parameters, don't do it ourselves here for clarity
89108
$fnret = OVH::Bastion::access_modify(
90-
way => 'personal',
91-
account => $account,
92-
action => $action,
93-
user => $user,
94-
ip => $ip,
95-
port => $port,
96-
ttl => $ttl,
97-
forceKey => $forceKey,
98-
forcePassword => $forcePassword,
99-
comment => $comment,
109+
way => 'personal',
110+
account => $account,
111+
action => $action,
112+
user => $user,
113+
ip => $ip,
114+
port => $port,
115+
ttl => $ttl,
116+
forceKey => $forceKey,
117+
forcePassword => $forcePassword,
118+
comment => $comment,
119+
widestV4Prefix => $widestV4Prefix,
100120
);
101121
if ($fnret->err eq 'OK') {
102122
my $ttlmsg = $ttl ? ' (expires in ' . OVH::Bastion::duration2human(seconds => $ttl)->value->{'human'} . ')' : '';

‎bin/plugin/restricted/accountAddPersonalAccess

+33
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,39 @@ if ($forceKey && $forcePassword) {
102102
osh_exit 'ERR_INCOMPATIBLE_PARAMETERS', "Can't use --force-key and --force-password at the same time";
103103
}
104104

105+
# check plugin config
106+
if ($pluginConfig && $pluginConfig->{'self_remote_user_only'}) {
107+
if (!$user || $user ne $account) {
108+
osh_exit('ERR_INVALID_PARAMETER',
109+
msg => "This bastion policy forces the remote user of personal accesses to match\n"
110+
. "the account name: you may retry with --user $account");
111+
}
112+
}
113+
114+
# if no comment is specified, but we're adding the server by hostname,
115+
# use it to craft a comment
116+
if (!$comment && $host ne $ip) {
117+
$comment = "hostname=$host";
118+
}
119+
120+
# use dryrun to validate all parameters
121+
$fnret = OVH::Bastion::access_modify(
122+
dryrun => 1,
123+
sudo => 0,
124+
way => 'personal',
125+
account => $account,
126+
action => 'add',
127+
user => $user,
128+
ip => $ip,
129+
port => $port,
130+
ttl => $ttl,
131+
forceKey => $forceKey,
132+
forcePassword => $forcePassword,
133+
comment => $comment,
134+
widestV4Prefix => ($pluginConfig ? $pluginConfig->{'widest_v4_prefix'} : undef),
135+
);
136+
$fnret or osh_exit($fnret);
137+
105138
osh_info "Can't verify whether $account\'s personal key has been installed to the remote server, "
106139
. "as you don't have access to their private keys, adding the access blindly";
107140

‎bin/plugin/restricted/selfAddPersonalAccess

+33-7
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,39 @@ if ($forceKey && $forcePassword) {
9090
osh_exit 'ERR_INCOMPATIBLE_PARAMETERS', "Can't use --force-key and --force-password at the same time";
9191
}
9292

93+
# check plugin config
94+
if ($pluginConfig && $pluginConfig->{'self_remote_user_only'}) {
95+
if (!$user || $user ne $self) {
96+
osh_exit('ERR_INVALID_PARAMETER',
97+
msg => "This bastion policy forces the remote user of personal accesses to match\n"
98+
. "the account name: you may retry with --user $self");
99+
}
100+
}
101+
102+
# if no comment is specified, but we're adding the server by hostname,
103+
# use it to craft a comment
104+
if (!$comment && $host ne $ip) {
105+
$comment = "hostname=$host";
106+
}
107+
108+
# use dryrun to validate all parameters
109+
$fnret = OVH::Bastion::access_modify(
110+
dryrun => 1,
111+
sudo => 0,
112+
way => 'personal',
113+
account => $self,
114+
action => 'add',
115+
user => $user,
116+
ip => $ip,
117+
port => $port,
118+
ttl => $ttl,
119+
forceKey => $forceKey,
120+
forcePassword => $forcePassword,
121+
comment => $comment,
122+
widestV4Prefix => ($pluginConfig ? $pluginConfig->{'widest_v4_prefix'} : undef),
123+
);
124+
$fnret or osh_exit($fnret);
125+
93126
if (not $force) {
94127
$fnret = OVH::Bastion::ssh_test_access_way(
95128
account => $self,
@@ -100,7 +133,6 @@ if (not $force) {
100133
forcePassword => $forcePassword
101134
);
102135
if ($fnret->is_ok and $fnret->err ne 'OK') {
103-
104136
# we have something to say, say it
105137
osh_info $fnret->msg;
106138
}
@@ -113,12 +145,6 @@ else {
113145
osh_info "Forcing add as asked, we didn't test the SSH connection, maybe it won't work!";
114146
}
115147

116-
# if no comment is specified, but we're adding the server by hostname,
117-
# use it to craft a comment
118-
if (!$comment && $host ne $ip) {
119-
$comment = "hostname=$host";
120-
}
121-
122148
my @command = qw{ sudo -n -u allowkeeper -- /usr/bin/env perl -T };
123149
push @command, $OVH::Bastion::BASEPATH . '/bin/helper/osh-accountModifyPersonalAccess';
124150
push @command, '--target', 'self';

‎tests/functional/tests.d/340-selfaccesses.sh

+34
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,40 @@ testsuite_selfaccesses()
121121
contain "already"
122122
json .command selfAddPersonalAccess .error_code OK_NO_CHANGE .value null
123123

124+
# test selfAddPersonalAccess config items
125+
success selfAddPersonalAccess_setconfig1 $r0 "echo '\{\\\"self_remote_user_only\\\":true\,\\\"widest_v4_prefix\\\":30\}' \> $opt_remote_etc_bastion/plugin.selfAddPersonalAccess.conf \; chmod o+r $opt_remote_etc_bastion/plugin.selfAddPersonalAccess.conf"
126+
127+
plgfail selfAddPersonalAccess_self_remote_user_only $a0 --osh selfAddPersonalAccess --host 127.0.0.9 --user notme --port-any
128+
json .error_code ERR_INVALID_PARAMETER
129+
contain "you may retry"
130+
131+
plgfail selfAddPersonalAccess_too_wide $a0 --osh selfAddPersonalAccess --host 127.0.0.0/8 --user $account0 --port-any
132+
json .error_code ERR_INVALID_PARAMETER
133+
contain "IPv4 is /30 by this"
134+
135+
success selfAddPersonalAccess_constraints_ok $a0 --osh selfAddPersonalAccess --host 127.0.0.9 --user $account0 --port-any --ttl 1 --force
136+
137+
success selfAddPersonalAccess_delconfig $r0 "rm -f $opt_remote_etc_bastion/plugin.selfAddPersonalAccess.conf"
138+
139+
# same with accountAddPersonalAccess
140+
grant accountAddPersonalAccess
141+
success accountAddPersonalAccess_setconfig1 $r0 "echo '\{\\\"self_remote_user_only\\\":true\,\\\"widest_v4_prefix\\\":30\}' \> $opt_remote_etc_bastion/plugin.accountAddPersonalAccess.conf \; chmod o+r $opt_remote_etc_bastion/plugin.accountAddPersonalAccess.conf"
142+
143+
plgfail accountAddPersonalAccess_self_remote_user_only $a0 --osh accountAddPersonalAccess --host 127.0.0.9 --user notme --port-any --account $account1
144+
json .error_code ERR_INVALID_PARAMETER
145+
contain "you may retry"
146+
147+
plgfail accountAddPersonalAccess_too_wide $a0 --osh accountAddPersonalAccess --host 127.0.0.0/8 --user $account1 --port-any --account $account1
148+
json .error_code ERR_INVALID_PARAMETER
149+
contain "IPv4 is /30 by this"
150+
151+
success accountAddPersonalAccess_constaints_ok $a0 --osh accountAddPersonalAccess --host 127.0.0.9 --user $account1 --port-any --ttl 1 --account $account1
152+
153+
success accountAddPersonalAccess_delconfig $r0 "rm -f $opt_remote_etc_bastion/plugin.accountAddPersonalAccess.conf"
154+
155+
revoke accountAddPersonalAccess
156+
# /test (self|account)AddPersonalAccess config items
157+
124158
success withttl $a0 -osh selfAddPersonalAccess -h 127.0.0.4 -u $shellaccount -p 22 --force --ttl 0d0h0m3s
125159
json .command selfAddPersonalAccess .error_code OK .value.ip 127.0.0.4 .value.user $shellaccount .value.port 22 .value.ttl 3
126160

0 commit comments

Comments
 (0)