Commit graph

144 commits

Author SHA1 Message Date
Stéphane Lesimple
4a21cfc421 enh: add --max-inactive-days to accountCreate 2021-09-06 14:52:46 +02:00
Stéphane Lesimple
ef10d509fd enh: add max_inactive_days to account configuration (#230) 2021-09-06 14:52:46 +02:00
Stéphane Lesimple
15cb2c2453 enh: accountInfo: add --list-groups
Listing groups can be slow on bastions having thousands
of groups, hence this is now disabled by default.
2021-09-02 13:13:44 +02:00
Stéphane Lesimple
f1e875ca4b fix: erroneous message in connect.pl 2021-09-02 11:42:18 +02:00
Stéphane Lesimple
56d4078605 feat: add --fallback-password-delay (3) for ssh password autologin 2021-09-02 11:42:18 +02:00
Stéphane Lesimple
5930775626 enh: better error message when unknown option is used 2021-09-02 10:07:03 +02:00
Stéphane Lesimple
cd5b61b239 chore: perlcritic: remove Variables::RequireInitializationForLocalVars check 2021-09-02 10:06:47 +02:00
Stéphane Lesimple
92d4a46ac5 doc: add osh-piv-grace-reaper.pl config reference 2021-09-02 10:06:47 +02:00
Stéphane Lesimple
9f28dfa977 doc: add osh-backup-acl-keys.sh config reference 2021-09-02 10:06:47 +02:00
Stéphane Lesimple
3c6ce52e8e doc: add osh-encrypt-rsync.pl config reference 2021-09-02 10:06:47 +02:00
Stéphane Lesimple
0dc448943a doc: add osh-sync-watcher.sh config reference 2021-09-02 10:06:47 +02:00
Stéphane Lesimple
9b2aa996b3 enh: better use of account creation metadata
Store account creation information in a JSON.
Display this information in `accountInfo` for auditors.
2021-07-23 09:50:18 +02:00
Stéphane Lesimple
c0bebf23d4 fix: accountCreate --uid-auto: rare case where a free UID couldn't be found
This happened when a free UID was found, along with a corresponding GID,
but the corresponding GID for the ttyrec group of the account was not
available. Now this is checked directly in get_next_available_uid()
2021-07-19 11:53:18 +02:00
Stéphane Lesimple
6b4418e864 chore: fixrights: ensure tests/functional/proxy/remote-daemon is +x 2021-07-16 11:05:04 +02:00
Stéphane Lesimple
2390f56c9a chore: groupCreate: fix help message 2021-07-02 18:25:24 +02:00
Stéphane Lesimple
f483b1540a enh: max account length is now 28 chars up from 18 2021-07-02 17:41:12 +02:00
thibault.dewailly
5415ed2793 Feat: Add admin and super owner accounts list in info plugin
For auditing purposes, get admin and super owner list in info plugin
Available for auditor role only
Closes #206
2021-06-28 11:13:30 +02:00
Stéphane Lesimple
2f1e3fbfa8 support: del deb8/ubuntu1404/opensuse150/opensuse151, add opensuse153
Remove support for EOL OSes:
- Debian 8
- Ubuntu 14.04
- OpenSUSE 15.0
- OpenSUSE 15.1

Add support for:
- OpenSUSE 15.3
2021-06-25 16:02:38 +02:00
Stéphane Lesimple
d400ceeb9f doc: clush: document --user and --port
Partly fixes #201
2021-06-23 12:24:32 +02:00
Stéphane Lesimple
8d2aaf8d8f fix: setup-first-admin-account.sh: support to add several admins
Fixes #202
2021-06-21 14:36:08 +02:00
Thomas Soëte
c61a3eaae9 Remove duplicate groupAddGuestAccess groupDelGuestAccess
groupAddGuestAccess groupDelGuestAccess are present twice in help
2021-06-21 09:39:35 +02:00
Stéphane Lesimple
2e9fe9288b enh: httpproxy: add options to fine-tune logging
Added the `log_request_response` and `log_request_response_max_size`
options to osh-http-proxy.conf.

By default, requests are logged, including their body, up to a size
of 64K per request response. Before, there was no size limit to the
logged body response.
2021-06-03 16:39:56 +02:00
Stéphane Lesimple
45cfb78b0b fix: httpproxy: allow more passthrough headers
The following additional header is now allowed to come back from the remote server to the client:
* Content-Length

The following additional headers are now passed through to the remote server:
* Content-Length
* Content-Encoding
2021-06-03 16:16:29 +02:00
Stéphane Lesimple
b364706f37 feat: httpproxy: add functional tests 2021-06-03 16:16:29 +02:00
Stéphane Lesimple
d6291f3ad4 feat: httpproxy: add and use execute_simple() for more performance
Also handle errors better in hand_http_request()
2021-06-03 16:16:29 +02:00
Stéphane Lesimple
7da3ef3e25 fix: connect.pl: decode 2K bytes of the ttyrec instead of 1K to not miss messages 2021-06-02 15:32:40 +02:00
Stéphane Lesimple
3925e67d43 feat: add groupDestroy command for owners
This command deletes a group, as `groupDelete` does, but works
for owners so that they can delete their own group.
`groupDelete` remains as a restricted command, able to delete any group.

Closes #40.
2021-06-02 15:32:40 +02:00
Stéphane Lesimple
8cc990ad57 feat: add filtering options to several cmds,nicify print_acls()
The commands selfListAccesses, accountListAccesses,
groupList, groupListServers, groupListGuestAccesses and
accountList now have options to filter their output through
pattern matching, with --include and --exclude.

The output from the commands using print_acls() is also more
human-friendly, with auto-adjusting column length, and empty
columns omitted.

Closes #60.
2021-05-25 09:42:28 +02:00
Stéphane Lesimple
adb9d8c374 feat: add UTF-8 chars to output when supported and allowed
To enhance the readability and visibility of important messages
(such as critical ones). This can be disabled with the `allowUTF8`
global option set to `false`. It's never enabled if the user locale
or their terminal don't seem to support it.
2021-05-24 16:44:35 +02:00
Stéphane Lesimple
60ad30ce5b fix: install: adjust a sed to be FreeBSD 13 compliant 2021-05-21 14:13:22 +02:00
Stéphane Lesimple
344865884b fix: groupCreate: deny groups starting with 'key'
Mitigates #178
2021-05-21 14:13:22 +02:00
Stéphane Lesimple
f4c59ca96b enh: setup-gpg.sh: clarify the use of ^D with --import
Closes #179
2021-05-19 18:56:32 +02:00
Stéphane Lesimple
e865964dd2 enh: setup-encryption.sh: check that luks-config.sh exists
As seen in #181
2021-05-19 18:56:17 +02:00
Stéphane Lesimple
68e088a607 doc: accountModify: more details on the --egress-strict-host-key-checking option 2021-05-19 18:55:54 +02:00
Jonathan Marsaud
b7b2533604 accountModify - Add a new accept-new POLICY in egress-strict-host-key-checking parameter 2021-05-19 16:34:35 +02:00
Jérémy Lecour
3e0202d914 Fix typo in unlock-home.sh
Typo : Mouting → Mounting
2021-05-19 15:30:32 +02:00
Stéphane Lesimple
c2b4bb192a fix: osh-help: put groupDelEgressKey in the proper category
Fixes #174
2021-04-16 09:09:26 +02:00
Stéphane Lesimple
90d6dc2e3c fix: superowners need to have +x on group homes 2021-04-09 09:46:14 +02:00
Stéphane Lesimple
e412083272 fix: accountCreate: incorrect help message (#167) 2021-04-08 12:04:19 +02:00
Stéphane Lesimple
5ec805f26b fix: groupGenerateEgressKey: --help wasn't working properly 2021-04-08 09:41:03 +02:00
Stéphane Lesimple
003052530e feat: preparatory work to support Debian 11 "Bullseye"
We still need to replacee pam_tally2 by pam_faillock
Debian 11 is NOT yet supported, and won't be before it's released as stable.
2021-03-24 17:41:29 +01:00
Stéphane Lesimple
1d9018ef7f fix: strict check failure was no longer detected to print a help message
Fixes #155
2021-03-24 17:41:14 +01:00
Stéphane Lesimple
3b4ea53cce fix: fixrights.sh: 'chmod --' not supported under FreeBSD 2021-03-24 10:47:11 +01:00
Stéphane Lesimple
1b04b800b8 fix: packages-check.sh: centos: ensure cache is up to date before trying to install packages 2021-03-24 10:47:11 +01:00
Stéphane Lesimple
5920b09aed chore: mkdir -p doesn't fail if dir already exists 2021-03-24 10:47:11 +01:00
Stéphane Lesimple
c5cd5d4464 fix: groupDelServer: missing autocompletion in interactive mode 2021-03-23 17:52:11 +01:00
Stéphane Lesimple
7b7c395c55 enh: osh-orphaned-homedir.sh: add more security checks to ensure we don't archive still-used home dirs 2021-03-19 14:39:31 +01:00
Stéphane Lesimple
7dabfc7135 fix: install-yubico-piv-checker: ppc64le installation was broken 2021-03-17 15:14:13 +01:00
Stéphane Lesimple
255f0684cc fix: scp: abort early if host is not found to avoid a warn()
The following warn would happen if the scp wrapper was called with an invalid hostname:

Use of uninitialized value  in bitwise and (&) at /usr/share/perl5/Net/Netmask.pm line 699.
 at /opt/bastion/bin/plugin/open/../../../lib/perl/OVH/Bastion.pm line 41.
 OVH::Bastion::__ANON__("Use of uninitialized value \ in bitwise and (&) at /usr/shar"...) called at /usr/share/perl5/Net/Netmask.pm line 697
 Net::Netmask::match(Net::Netmask=HASH(0x55b1d5f11860), undef) called at /opt/bastion/lib/perl/OVH/Bastion/allowdeny.inc line 214
 OVH::Bastion::is_access_way_granted("port", 22, "exactUserMatch", 1, "ipfrom", "X.X.X.X", "ip", undef, ...) called at /opt/bastion/lib/perl/OVH/Bastion/allowdeny.inc line 688
 OVH::Bastion::is_access_granted(\"account\", \"johndoe\", \"user\", \"!scpupload\", \"ipfrom\", \"X.X.X.X\", \"ip\", undef, ...) called at /opt/bastion/bin/plugin/open/scp line 136
2021-03-01 09:31:38 +01:00
Stéphane Lesimple
6ae85d5afd fix: osh-backup-acl-keys: detect file removed transient error 2021-03-01 09:30:55 +01:00