Commit graph

46 commits

Author SHA1 Message Date
Stéphane Lesimple
2390f56c9a chore: groupCreate: fix help message 2021-07-02 18:25:24 +02:00
thibault.dewailly
5415ed2793 Feat: Add admin and super owner accounts list in info plugin
For auditing purposes, get admin and super owner list in info plugin
Available for auditor role only
Closes #206
2021-06-28 11:13:30 +02:00
Stéphane Lesimple
d400ceeb9f doc: clush: document --user and --port
Partly fixes #201
2021-06-23 12:24:32 +02:00
Thomas Soëte
c61a3eaae9 Remove duplicate groupAddGuestAccess groupDelGuestAccess
groupAddGuestAccess groupDelGuestAccess are present twice in help
2021-06-21 09:39:35 +02:00
Stéphane Lesimple
3925e67d43 feat: add groupDestroy command for owners
This command deletes a group, as `groupDelete` does, but works
for owners so that they can delete their own group.
`groupDelete` remains as a restricted command, able to delete any group.

Closes #40.
2021-06-02 15:32:40 +02:00
Stéphane Lesimple
8cc990ad57 feat: add filtering options to several cmds,nicify print_acls()
The commands selfListAccesses, accountListAccesses,
groupList, groupListServers, groupListGuestAccesses and
accountList now have options to filter their output through
pattern matching, with --include and --exclude.

The output from the commands using print_acls() is also more
human-friendly, with auto-adjusting column length, and empty
columns omitted.

Closes #60.
2021-05-25 09:42:28 +02:00
Stéphane Lesimple
adb9d8c374 feat: add UTF-8 chars to output when supported and allowed
To enhance the readability and visibility of important messages
(such as critical ones). This can be disabled with the `allowUTF8`
global option set to `false`. It's never enabled if the user locale
or their terminal don't seem to support it.
2021-05-24 16:44:35 +02:00
Stéphane Lesimple
344865884b fix: groupCreate: deny groups starting with 'key'
Mitigates #178
2021-05-21 14:13:22 +02:00
Stéphane Lesimple
68e088a607 doc: accountModify: more details on the --egress-strict-host-key-checking option 2021-05-19 18:55:54 +02:00
Jonathan Marsaud
b7b2533604 accountModify - Add a new accept-new POLICY in egress-strict-host-key-checking parameter 2021-05-19 16:34:35 +02:00
Stéphane Lesimple
c2b4bb192a fix: osh-help: put groupDelEgressKey in the proper category
Fixes #174
2021-04-16 09:09:26 +02:00
Stéphane Lesimple
e412083272 fix: accountCreate: incorrect help message (#167) 2021-04-08 12:04:19 +02:00
Stéphane Lesimple
5ec805f26b fix: groupGenerateEgressKey: --help wasn't working properly 2021-04-08 09:41:03 +02:00
Stéphane Lesimple
c5cd5d4464 fix: groupDelServer: missing autocompletion in interactive mode 2021-03-23 17:52:11 +01:00
Stéphane Lesimple
255f0684cc fix: scp: abort early if host is not found to avoid a warn()
The following warn would happen if the scp wrapper was called with an invalid hostname:

Use of uninitialized value  in bitwise and (&) at /usr/share/perl5/Net/Netmask.pm line 699.
 at /opt/bastion/bin/plugin/open/../../../lib/perl/OVH/Bastion.pm line 41.
 OVH::Bastion::__ANON__("Use of uninitialized value \ in bitwise and (&) at /usr/shar"...) called at /usr/share/perl5/Net/Netmask.pm line 697
 Net::Netmask::match(Net::Netmask=HASH(0x55b1d5f11860), undef) called at /opt/bastion/lib/perl/OVH/Bastion/allowdeny.inc line 214
 OVH::Bastion::is_access_way_granted("port", 22, "exactUserMatch", 1, "ipfrom", "X.X.X.X", "ip", undef, ...) called at /opt/bastion/lib/perl/OVH/Bastion/allowdeny.inc line 688
 OVH::Bastion::is_access_granted(\"account\", \"johndoe\", \"user\", \"!scpupload\", \"ipfrom\", \"X.X.X.X\", \"ip\", undef, ...) called at /opt/bastion/bin/plugin/open/scp line 136
2021-03-01 09:31:38 +01:00
Stéphane Lesimple
4fd010c355 chore: microfixes after review 2021-02-22 13:32:19 +01:00
Stéphane Lesimple
8a0f7c6b4f fix: accountInfo: get rid of a warn()
This occurred since v3.01.99-rc1 when requesting an accountInfo
of an account without an ingress_piv_policy set.

Use of uninitialized value  in concatenation (.) or string at /usr/share/perl/5.28/Term/ANSIColor.pm line 510.
 at /opt/bastion/bin/plugin/restricted/../../../lib/perl/OVH/Bastion.pm line 41.
OVH::Bastion::__ANON__("Use of uninitialized value \ in concatenation (.) or st"...) called at /usr/share/perl/5.28/Term/ANSIColor.pm line 510
Term::ANSIColor::colored(undef, "green") called at /opt/bastion/bin/plugin/restricted/accountInfo line 178
2021-02-22 11:56:33 +01:00
Stéphane Lesimple
edb1b77dfc feat: auto-add hostname as comment in groupAddServer / selfAddPersonalAccesss
Implements a side suggestion of #60
2021-02-22 11:56:19 +01:00
Stéphane Lesimple
383f2a011c enh: guests: groupAddGuestAccess now supports setting a comment
If no comment is set, the comment is inherited from the group ACL,
as seen in groupListServers.

selfAddPersonalAccess now also return details
about the added server in the returned JSON.

Closes #18
Closes #17
2021-02-22 11:56:19 +01:00
Stéphane Lesimple
5eb5135d26 doc: update 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
e760cf6142 feat: add groupGenerateEgressKey and groupDelEgressKey 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
e235199715 fix: groupModify: deny early if user is not an owner of the group
This way, the error message is clearer
2021-02-17 10:03:40 +01:00
Stéphane Lesimple
7eeccb7c5d enh: groupInfo: nicer message when no egress key exists 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
efe3710e4c feat: groupList/accountList: add --include --exclude 2021-01-21 15:56:59 +01:00
Stéphane Lesimple
148d5206e5 enh: rootListIngressKeys: look for all well-known authkeys files 2021-01-21 15:06:27 +01:00
Stéphane Lesimple
69778815bb enh: groupList: use cache to speedup calls
On bastions with thousands of group, the speedup is ~x10
2021-01-20 14:01:55 +01:00
Pierre Kuhner
e7e045a40d fix: confusing error messages in groupDelServer 2021-01-14 09:40:55 +01:00
Stéphane Lesimple
1676979913 feat: add PIV keys support and policy enforcement
A new global option 'ingressRequirePIV' was added, to enable or disable a
bastion-wide policy forcing everybody to use only PIV keys.
2021-01-12 12:05:06 +01:00
Stéphane Lesimple
a204313af9
feat: accountModify: add --osh-only (closes #97) 2020-12-18 11:04:33 +00:00
Stéphane Lesimple
03ad1da046
chore: perlcritic: including forgotten .inc files 2020-12-15 17:18:37 +00:00
Thomas Soëte
9647ae9cdb
fix: Fix 'selfAddPersonalAccess' helptext 2020-12-01 15:53:57 +01:00
Stéphane Lesimple
4cb09a9570
nh: remove hardcoded .ssh/authorized_keys2 everywhere 2020-11-26 18:08:03 +00:00
Stéphane Lesimple
71cd9a46df
Merge branch 'master' into autocompletion 2020-11-23 14:26:46 +01:00
Stéphane Lesimple
9fb6b8d444
enh: accountCreate: handle --uid-auto in autocompletion rules 2020-11-23 11:29:52 +00:00
Thomas SOËTE
ef531308d5 enh: doc: add from parameter as it is mandatory 2020-11-23 11:28:15 +00:00
Stéphane Lesimple
f07e00b1e9
Merge branch 'master' into adminSudo 2020-11-23 10:05:11 +01:00
Stéphane Lesimple
e2a64a9d8f
enh: adminSudo: better autocompletion rules 2020-11-23 08:35:28 +00:00
Thomas SOËTE
2a51a78b54 fix: Enable perl-tidy.sh test
* Move to ubuntu-20.04 runner
* Remove check in dockers tests
2020-11-22 21:37:34 +00:00
Thomas SOËTE
632076565e Fix sort of the list of past sessions 2020-11-18 09:50:56 +00:00
Stéphane Lesimple
60cea897f8 enh: osh.pl: replace harcoded selfMFASetupPassword logic by configuration 2020-11-17 11:28:05 +01:00
snk33
7685114cfd
allow adminSudo plugin to read from stdin
add expects_stdin to the execute call so an admin will be able to replay session from another account
2020-11-13 18:35:40 +01:00
Stéphane Lesimple
5c72c92bdd
chore: fix typos everywhere 2020-11-05 17:36:17 +00:00
Stéphane Lesimple
d3a7818046
Merge pull request #10 from ovh/issue-8
fix: accountModify is master-only
2020-10-22 12:26:53 +02:00
Stéphane Lesimple
4b8b1457e9
fix: accountModify is master-only 2020-10-22 10:24:14 +00:00
Romain Beuque
cb1e54b42a
clush: change description for --no-pause-on-failure to represent the actual behavior
Signed-off-by: Romain Beuque <romain.beuque@ovhcloud.com>
2020-10-22 12:21:29 +02:00
Stéphane Lesimple
fde20136ef
Initial commit 2020-10-20 14:30:27 +00:00