Commit graph

24 commits

Author SHA1 Message Date
Stéphane Lesimple
f483b1540a enh: max account length is now 28 chars up from 18 2021-07-02 17:41:12 +02:00
Stéphane Lesimple
3925e67d43 feat: add groupDestroy command for owners
This command deletes a group, as `groupDelete` does, but works
for owners so that they can delete their own group.
`groupDelete` remains as a restricted command, able to delete any group.

Closes #40.
2021-06-02 15:32:40 +02:00
Jonathan Marsaud
b7b2533604 accountModify - Add a new accept-new POLICY in egress-strict-host-key-checking parameter 2021-05-19 16:34:35 +02:00
Stéphane Lesimple
90d6dc2e3c fix: superowners need to have +x on group homes 2021-04-09 09:46:14 +02:00
Stéphane Lesimple
383f2a011c enh: guests: groupAddGuestAccess now supports setting a comment
If no comment is set, the comment is inherited from the group ACL,
as seen in groupListServers.

selfAddPersonalAccess now also return details
about the added server in the returned JSON.

Closes #18
Closes #17
2021-02-22 11:56:19 +01:00
Stéphane Lesimple
9216e2db1b enh: groupAddServer: augment the returned JSON with the added server details 2021-02-22 11:56:19 +01:00
Stéphane Lesimple
e760cf6142 feat: add groupGenerateEgressKey and groupDelEgressKey 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
7eeccb7c5d enh: groupInfo: nicer message when no egress key exists 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
148d5206e5 enh: rootListIngressKeys: look for all well-known authkeys files 2021-01-21 15:06:27 +01:00
Stéphane Lesimple
1676979913 feat: add PIV keys support and policy enforcement
A new global option 'ingressRequirePIV' was added, to enable or disable a
bastion-wide policy forcing everybody to use only PIV keys.
2021-01-12 12:05:06 +01:00
Stéphane Lesimple
16323667e2
Merge pull request #106 from ovh/logs
feat: revamp logs
2021-01-05 18:50:25 +01:00
Stéphane Lesimple
a479810d83
feat: revamp logs
All connections and plugin executions emit two logs, an 'open' and
a 'close' log. We now add all the details of the connection to
the 'close' logs, those that were previously only available in the
corresponding 'open' log. This way, it is no longer required to
correlate both logs with their uniqid to have all the data:
the 'close' log should suffice. The 'open' log is still there if
for some reason the 'close' log can't be emitted (kill -9, system
crash, etc.), or if the 'open' and the 'close' log are several
hours, days or months appart.

An additional field "duration" has been added to the 'close' logs,
this represents the number of seconds (with millisecond precision)
the connection lasted.

Two new fields "globalsql" and "accountsql" have been added to the
'open'-type logs. These will contain either "ok" if we successfully
logged to the corresponding log database, "no" if it is disabled,
or "error $aDetailedMessage" if we got an error trying to insert
the row. The 'close'-type log also has the new "accountsql_close"
field, but misses the "globalsql_close" field as we never update
the global database on this event. On the 'close' log, we can also
have the value "missing", indicating that we couldn't update the
access log row in the database, as the corresponding 'open' log
couldn't insert it.

The "ttyrecsize" log field for the 'close'-type logs has been removed,
as it was never completely implemented, and contains bogus data if
ttyrec log rotation occurs. It has also been removed from the sqlite
log databases.

The 'open' and 'close' events are now pushed to our own log files,
in addition to syslog, if logging to those files is enabled (see
``enableGlobalAccesssLog`` and ``enableAccountAccessLog``), previously
the 'close' events were only pushed to syslog.

The /home/osh.log is no longer used for ``enableGlobalAccessLog``, the
global log is instead written to /home/logkeeper/global-log-YYYYMM.log.

The global sql file, enabled with ``enableGlobalSqlLog``, is now
split by year-month instead of by year, to
/home/logkeeper/global-log-YYYYMM.sqlite.
2020-12-29 16:14:50 +00:00
Stéphane Lesimple
2cfde997f3 fix: realmDelete: bad sudoers configuration 2020-12-25 17:02:54 +01:00
Stéphane Lesimple
a204313af9
feat: accountModify: add --osh-only (closes #97) 2020-12-18 11:04:33 +00:00
Stéphane Lesimple
a676692fe6
chore: fix an error message 2020-12-15 13:57:58 +00:00
Antoine Leblanc
82f2c96ea6
fix: osh-accountDelete: fix typo
Signed-off-by: Antoine Leblanc <antoine.leblanc@ovhcloud.com>
2020-12-14 21:49:32 +01:00
Stéphane Lesimple
e2186978da
fix: sudogen: don't check for account/groups validity too much when deleting them
Fixes #86
2020-12-14 09:19:03 +00:00
Stéphane Lesimple
c68b696702
chore: shellcheck & perltidy 2020-12-08 14:42:31 +00:00
Stéphane Lesimple
7707b1c351
fix: osh-groupCreate: fix for centos 8.3 2020-12-08 14:42:27 +00:00
Stéphane Lesimple
50c016be10
fix: sudogen: properly handle accounts & groups containing '.' 2020-12-03 13:20:53 +00:00
Stéphane Lesimple
4cb09a9570
nh: remove hardcoded .ssh/authorized_keys2 everywhere 2020-11-26 18:08:03 +00:00
Thomas SOËTE
2a51a78b54 fix: Enable perl-tidy.sh test
* Move to ubuntu-20.04 runner
* Remove check in dockers tests
2020-11-22 21:37:34 +00:00
Stéphane Lesimple
4105c10193 fix: freebsd: replace 'root' by '0' so that it works even if uid0's name is not root 2020-11-17 11:12:53 +01:00
Stéphane Lesimple
fde20136ef
Initial commit 2020-10-20 14:30:27 +00:00