mirror of
https://github.com/ovh/the-bastion.git
synced 2025-09-05 04:24:11 +08:00
chore: fix spurious empty lines at end of generated rst files
This commit is contained in:
parent
458c50eff1
commit
ecee68c8bc
79 changed files with 3 additions and 234 deletions
|
@ -42,7 +42,7 @@ do
|
|||
if [ -e "doc/sphinx-plugins-override/$name.override.rst" ]; then
|
||||
cat "doc/sphinx-plugins-override/$name.override.rst"
|
||||
else
|
||||
perl "$pluginfile" '' '' '' '' | perl -ne '
|
||||
perl "$pluginfile" '' '' '' '' | perl -e 'undef $/; $_=<>; s/\n+$/\n/; print $_' | perl -ne '
|
||||
if (m{^Usage: (.+)}) { print ".. admonition:: usage\n :class: cmdusage\n\n $1\n\n.. program:: '"$name"'\n\n"; }
|
||||
elsif (m{^ (-[- ,a-z|/A-Z"'"'"']+) (.+)}) { print ".. option:: $1\n\n $2\n\n"; }
|
||||
elsif ($l++ == 0) { chomp; print "$_\n"."="x(length($_))."\n\n"; }
|
||||
|
|
|
@ -26,6 +26,3 @@ Manage the bastion maintenance mode
|
|||
|
||||
Optionally set a maintenance reason, if you're in a shell, quote it twice.
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -29,6 +29,3 @@ Example::
|
|||
|
||||
Don't forget the double-double-dash as seen in the example above: one after the plugin name,
|
||||
and another one to separate adminSudo options from the options of the plugin to be called.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -68,6 +68,3 @@ Examples::
|
|||
|
||||
--osh groupAddServer --group grp1 --host 203.0.113.0/24 --user-any --port-any --force --comment '"a whole network"'
|
||||
--osh groupAddServer --group grp2 --host srv1.example.org --user root --port 22
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -46,6 +46,3 @@ Remove an IP or IP block from a group's serrver list
|
|||
|
||||
Remove SCP download right, you<--bastion--server (omit --user in this case)
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -71,6 +71,3 @@ key instead of the group key, please use ``accountAddPersonalAccess`` instead (h
|
|||
must be on the remote server).
|
||||
|
||||
This command is the opposite of ``groupDelGuestAccess``.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -27,6 +27,3 @@ The specified account will be able to access all present and future servers
|
|||
pertaining to this group.
|
||||
If you need to give a specific and/or temporary access instead,
|
||||
see ``groupAddGuestAccess``
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -58,6 +58,3 @@ If you want to remove access from an account from a group server but using his p
|
|||
key instead of the group key, please use ``accountDelPersonalAccess`` instead.
|
||||
|
||||
This command is the opposite of ``groupAddGuestAccess``.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -27,6 +27,3 @@ The specified account will no longerr be able to access all present and future s
|
|||
pertaining to this group.
|
||||
Note that if this account also had specific guest accesses to this group, they may
|
||||
still apply, see ``groupListGuestAccesses``
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -41,6 +41,3 @@ List the guest accesses to servers of a group specifically granted to an account
|
|||
**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
|
||||
If PATTERN is a simple string without wildcards, then names containing this string will be considered.
|
||||
The matching is done on the text output of the command.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -24,6 +24,3 @@ Add the group aclkeeper role to an account
|
|||
|
||||
|
||||
The specified account will be able to manage the server list of this group
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -25,6 +25,3 @@ Add the group gatekeeper role to an account
|
|||
|
||||
The specified account will be able to manage the members list of this group,
|
||||
along with the guests list
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -27,6 +27,3 @@ The specified account will be able to manage the owner, gatekeeper
|
|||
and aclkeeper list of this group. In other words, this account will
|
||||
have all possible rights to manage the group and delegate some or all
|
||||
of the rights to other accounts
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -24,6 +24,3 @@ Remove the group aclkeeper role from an account
|
|||
|
||||
|
||||
The specified account will no longer be able to manage the server list of this group
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -22,6 +22,3 @@ Remove a bastion group egress key
|
|||
|
||||
Specify the key ID to delete, you can get it with groupInfo
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -25,6 +25,3 @@ Remove the group gatekeeper role from an account
|
|||
|
||||
The specified account will no longer be able to manager the members nor
|
||||
the guest list of this group
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -25,6 +25,3 @@ Remove the group owner role from an account
|
|||
|
||||
The specified account will no longer be able to manage the owner,
|
||||
gatekeeper and aclkeeper lists of this group
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -25,6 +25,3 @@ Delete a group
|
|||
|
||||
This command is able to delete any group you're an owner of.
|
||||
Granted users to the sibling restricted command `groupDelete` can delete any group.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -54,6 +54,3 @@ A quick overview of the different algorithms::
|
|||
|
||||
This table is meant as a quick cheat-sheet, you're warmly advised to do
|
||||
your own research, as other constraints may apply to your environment.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -38,6 +38,3 @@ egress password to use right away for the group, for any access that requires it
|
|||
A fallback mechanism exists that will auto-try the previous password if this one
|
||||
doesn't work, but please ensure that this new password is deployed on the remote
|
||||
devices as soon as possible.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -27,6 +27,3 @@ Modify the configuration of a group
|
|||
This group will enforce TTL setting, on guest access creation, to be set, and not to a higher value than DURATION,
|
||||
|
||||
set to zero to allow guest accesses creation without any TTL set (default)
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -25,6 +25,3 @@ Transmit your group ownership to somebody else
|
|||
|
||||
Note that this command has the same net effect than using ``groupAddOwner``
|
||||
to add ACCOUNT as an owner, then removing yourself with ``groupDelOwner``
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -21,6 +21,3 @@ Note that if you want to ssh to it afterwards, you can simply use the ``--wait``
|
|||
|
||||
hostname or IP to ping
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -35,6 +35,3 @@ Run a batch of osh commands fed through STDIN
|
|||
::
|
||||
|
||||
for i in user1 user2 user3; do echo "groupAddMember --account $i --group grp4"; done | bssh --osh batch
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -42,6 +42,3 @@ Launch a remote command on several machines sequentially (clush-like)
|
|||
|
||||
Command to be run on the remote hosts. If you're in a shell, quote it twice as shown.
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,9 +18,6 @@ Print some basic information about a group
|
|||
|
||||
specify the group to display the infos of
|
||||
|
||||
|
||||
|
||||
|
||||
Output example
|
||||
==============
|
||||
|
||||
|
|
|
@ -32,6 +32,3 @@ List the groups available on this bastion
|
|||
|
||||
**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
|
||||
If PATTERN is a simple string without wildcards, then names containing this string will be considered.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -20,6 +20,3 @@ List the hashes and metadata of egress passwords of a group
|
|||
|
||||
|
||||
The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -37,6 +37,3 @@ List the servers (IPs and IP blocks) pertaining to a group
|
|||
**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
|
||||
If PATTERN is a simple string without wildcards, then names containing this string will be considered.
|
||||
The matching is done on the text output of the command.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -13,9 +13,6 @@ I'm So Meta, Even This Acronym
|
|||
|
||||
.. program:: help
|
||||
|
||||
|
||||
|
||||
|
||||
Displays help about the available plugins callable with ``--osh``.
|
||||
|
||||
If you need help on a specific plugin, you can use ``--osh PLUGIN --help``, replacing ``PLUGIN`` with the actual plugin name.
|
||||
|
|
|
@ -13,9 +13,6 @@ Displays some information about this bastion instance
|
|||
|
||||
.. program:: info
|
||||
|
||||
|
||||
|
||||
|
||||
Output example
|
||||
==============
|
||||
|
||||
|
|
|
@ -13,9 +13,6 @@ Manually lock all your current sessions
|
|||
|
||||
.. program:: lock
|
||||
|
||||
|
||||
|
||||
|
||||
This command will lock all your current sessions on this bastion instance. Note that this only applies to the bastion instance you're launching this command on, not on the whole bastion cluster (if you happen to have one).
|
||||
|
||||
To undo this action, you can use ``--osh unlock`` on the same instance.
|
||||
|
|
|
@ -18,6 +18,3 @@ Runs the mtr tool to traceroute a host
|
|||
|
||||
Don't run mtr interactively, output a text report once done
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -26,7 +26,4 @@ Check whether a remote TCP port is open
|
|||
|
||||
Timeout in seconds (default: 3)
|
||||
|
||||
|
||||
|
||||
|
||||
Note that this is not a full-featured ``netcat``, we just test whether a remote port is open. There is no way to exchange data using this command.
|
||||
|
|
|
@ -30,6 +30,3 @@ Ping a remote host from the bastion
|
|||
|
||||
Exit unconditionally after this amount of seconds
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -28,6 +28,3 @@ Add a new ingress public key to your account
|
|||
|
||||
certificate, both in PEM format. If you specified --public-key, then the attestation and key certificate are
|
||||
expected on STDIN only, otherwise the public SSH key, the attestation and key certificate are expected on STDIN.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -24,6 +24,3 @@ Remove an ingress public key from your account
|
|||
|
||||
|
||||
If none of these options are specified, you'll be prompted interactively.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -26,6 +26,3 @@ Forget a known host key from your bastion account
|
|||
This command is useful to remove the man-in-the-middle warning when a key has changed,
|
||||
however please verify that the host key change is legit before using this command.
|
||||
The warning SSH gives is there for a reason.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -34,6 +34,3 @@ egress password to use right away for your account, for any access that requires
|
|||
A fallback mechanism exists that will auto-try the previous password if this one
|
||||
doesn't work, but please ensure that this new password is deployed on the remote
|
||||
devices as soon as possible.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -31,6 +31,3 @@ know that devices you need to access are using an HTTPS API.
|
|||
|
||||
BEWARE: once a new password is generated this way, it'll be set as the new
|
||||
HTTPS proxy ingress password to use right away for your account.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -38,6 +38,3 @@ Show the list of servers you have access to
|
|||
**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
|
||||
If PATTERN is a simple string without wildcards, then names containing this string will be considered.
|
||||
The matching is done on the text output of the command.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,6 +18,3 @@ The keys listed are the public egress SSH keys tied to your account.
|
|||
They can be used to gain access to another machine from this bastion,
|
||||
by putting one of those keys in the remote machine's ``authorized_keys`` file,
|
||||
and adding yourself access to this machine with ``selfAddPersonalAccess``.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -17,6 +17,3 @@ List the public ingress keys of your account
|
|||
The keys listed are the public ingress SSH keys tied to your account.
|
||||
Their private counterpart should be detained only by you, and used
|
||||
to authenticate yourself to this bastion.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -15,6 +15,3 @@ List the hashes and metadata of the egress passwords associated to your account
|
|||
|
||||
|
||||
The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -71,6 +71,3 @@ List the few past sessions of your account
|
|||
|
||||
Note that only the sessions that happened on this precise bastion instance will be shown,
|
||||
not the sessions from its possible cluster siblings.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -16,6 +16,3 @@ Remove the UNIX password of your account
|
|||
|
||||
Note that if your password is set, you'll be prompted for it.
|
||||
Also note that this doesn't remove your UNIX password requirement, if set (see ``accountModify`` for this).
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -16,6 +16,3 @@ Remove the TOTP configuration of your account
|
|||
|
||||
Note that if your TOTP is set, you'll be prompted for it.
|
||||
Also note that this doesn't remove your TOTP requirement, if set (see accountModify for this).
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,6 +18,3 @@ Setup an additional credential (UNIX password) to access your account
|
|||
|
||||
Don't ask for confirmation
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,6 +18,3 @@ Setup an additional credential (TOTP) to access your account
|
|||
|
||||
Bypass the confirmation step for TOTP enrollment phase
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,6 +18,3 @@ Replay the ttyrec of a past session
|
|||
|
||||
ID of the session to replay, use ``selfListSessions`` to find it.
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,6 +18,3 @@ This command will unlock all your current sessions on this bastion instance,
|
|||
that were either locked for inactivity timeout or manually locked by you with ``lock``.
|
||||
Note that this only applies to the bastion instance you're launching this
|
||||
command on, not on the whole bastion cluster (if you happen to have one).
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -61,6 +61,3 @@ Add a personal server access to an account
|
|||
|
||||
The access will work only if one of the account's personal egress public key has been copied to the remote server.
|
||||
To get the list of an account's personal egress public keys, see ``accountListEgressKeyss`` and ``selfListEgressKeys``.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -56,6 +56,3 @@ Create a new bastion account
|
|||
|
||||
Time after which the account will be deactivated (amount of seconds, or duration string such as "4d12h15m")
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -46,6 +46,3 @@ Remove a personal server access from an account
|
|||
|
||||
Remove SCP download right, you<--bastion--server (omit --user in this case)
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -22,6 +22,3 @@ Delete an account from the bastion
|
|||
|
||||
Don't ask for confirmation, and blame yourself if you deleted the wrong account
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -38,6 +38,3 @@ egress password to use right away for the account, for any access that requires
|
|||
A fallback mechanism exists that will auto-try the previous password if this one
|
||||
doesn't work, but please ensure that this new password is deployed on the remote
|
||||
devices as soon as possible.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -29,6 +29,3 @@ but then they'll be able to grant themselves or anybody else to this or any othe
|
|||
A specific command that can be granted is ``auditor``, it is not an osh plugin per-se, but activates
|
||||
more verbose output for several other commands, suitable to audit rights or grants without needing
|
||||
to be granted (e.g. to groups).
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,9 +18,6 @@ Display some information about an account
|
|||
|
||||
The account name to work on
|
||||
|
||||
|
||||
|
||||
|
||||
Output example
|
||||
==============
|
||||
|
||||
|
|
|
@ -40,6 +40,3 @@ List the bastion accounts
|
|||
|
||||
**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
|
||||
If PATTERN is a simple string without wildcards, then names containing this string will be considered.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -42,6 +42,3 @@ View the expanded access list of a given bastion account
|
|||
**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
|
||||
If PATTERN is a simple string without wildcards, then names containing this string will be considered.
|
||||
The matching is done on the text output of the command.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -23,6 +23,3 @@ The keys listed are the public egress SSH keys tied to this account.
|
|||
They can be used to gain access to another machine from this bastion,
|
||||
by putting one of those keys in the remote machine's ``authorized_keys`` file,
|
||||
and adding this account access to this machine with ``accountAddPersonalAccess``.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -22,6 +22,3 @@ List the public ingress keys of an account
|
|||
The keys listed are the public ingress SSH keys tied to this account.
|
||||
Their private counterpart should be detained only by this account's user,
|
||||
so that they can to authenticate themselves to this bastion.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -20,6 +20,3 @@ List the hashes and metadata of the egress passwords associated to an account
|
|||
|
||||
|
||||
The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -20,6 +20,3 @@ Remove the UNIX password of an account
|
|||
|
||||
|
||||
Note that if doesn't remove the account UNIX password requirement, if set (see ``accountModify`` for this)
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -20,6 +20,3 @@ Remove the TOTP configuration of an account
|
|||
|
||||
|
||||
Note that if doesn't remove the TOTP requirement, if set (see ``accountModify`` for this).
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -63,6 +63,3 @@ Modify an account configuration
|
|||
|
||||
If enabled, this account can only use ``--osh`` commands, and can't connect anywhere through the bastion
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -49,6 +49,3 @@ grace
|
|||
for this account, or if the global :ref:`ingressRequirePIV` option is set to true. This policy requires the use of the ``--ttl`` option to
|
||||
specify how much time the policy will be relaxed for this account before going back to its previous policy automatically. This can be
|
||||
useful when people forget their PIV-enabled hardware token and you don't want to send them back home.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -22,6 +22,3 @@ Revoke access to a restricted command
|
|||
|
||||
The name of the OSH plugin to revoke access to (omit to get the list)
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -21,6 +21,3 @@ Unexpire an inactivity-expired account
|
|||
|
||||
When the bastion is configured to expire accounts that haven't been seen in a while,
|
||||
this command can be used to activate them back.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -25,6 +25,3 @@ Delete a group
|
|||
|
||||
This restricted command is able to delete any group. Group owners can however delete
|
||||
their own groups using the sibling `groupDestroy` command.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -32,6 +32,3 @@ Declare and create a new trusted realm
|
|||
Public SSH key to deposit on the bastion to access this realm. If not present,
|
||||
|
||||
you'll be prompted interactively for it. Use double-quoting if your're under a shell.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,6 +18,3 @@ Delete a bastion realm
|
|||
|
||||
Name of the realm to delete
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,6 +18,3 @@ Display information about a bastion realm
|
|||
|
||||
Name of the realm to show info about
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -18,6 +18,3 @@ List the bastions realms
|
|||
|
||||
Only list the specified realm (mainly: check if it exists)
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -17,6 +17,3 @@ List the public keys to connect as root on this bastion
|
|||
This command is mainly useful for auditability purposes.
|
||||
As it gives some information as to who can be root on the underlying system,
|
||||
please grant this command only to accounts that need to have this information.
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -58,6 +58,3 @@ Add a personal server access on your account
|
|||
|
||||
Add a comment alongside this server. Quote it twice as shown if you're under a shell.
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -42,6 +42,3 @@ Remove a personal server access from your account
|
|||
|
||||
Remove SCP download right, you<--bastion--server (omit --user in this case)
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -45,6 +45,3 @@ Note: This list is what the bastion THINKS is true, which means that if some gro
|
|||
then it'll show all the members of that group as having access to the machine you're specifying, through this group key.
|
||||
This is only true if the remote server does have the group key installed, of course, which the bastion
|
||||
can't tell without trying to connect "right now" (which it won't do).
|
||||
|
||||
|
||||
|
||||
|
|
|
@ -427,10 +427,10 @@ sub osh_exit { ## no critic (ArgUnpacking)
|
|||
$R = R(@_);
|
||||
}
|
||||
|
||||
if (!$R) {
|
||||
if (!$R && $R->msg) {
|
||||
OVH::Bastion::osh_crit($R->msg);
|
||||
}
|
||||
elsif ($R->msg ne $R->err) {
|
||||
elsif ($R->msg ne $R->err && $R->msg) {
|
||||
OVH::Bastion::osh_info($R->msg);
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Reference in a new issue