Commit graph

97 commits

Author SHA1 Message Date
Stéphane Lesimple
858598d80b chore: add debug info in get_acls() 2021-07-15 18:27:42 +02:00
Stéphane Lesimple
f483b1540a enh: max account length is now 28 chars up from 18 2021-07-02 17:41:12 +02:00
Stéphane Lesimple
a447662cfd release v3.04.00 2021-07-02 17:31:47 +02:00
Stéphane Lesimple
01690e8111 bump to v3.03.99-rc2 2021-06-30 17:20:48 +02:00
Stéphane Lesimple
ecee68c8bc chore: fix spurious empty lines at end of generated rst files 2021-06-30 15:52:47 +02:00
Stéphane Lesimple
b942131092 fix: use local $_ before while(<>) loops
This closes a range of bugs that can happen if a function using $_ implicitly
in a while is called in a grep {} or map {} which also uses $_
2021-06-30 09:53:04 +02:00
Stéphane Lesimple
2193ee487d enh: replace 'allowUTF8' (introduced in rc1) by 'fanciness' 2021-06-30 09:53:04 +02:00
Stéphane Lesimple
c201f44d83 enh: tests: refactor the framework for more maintainability
The chain of executions is as is:
- `docker_build_and_run_tests_all.sh`
  - launches several instances of `docker_build_and_run_tests.sh`
    - builds docker images with the `target_role.sh` and `tester_role.sh` entrypoints
      - inside the tester docker, `tester_role.sh` launches `launch_tests_on_instance.sh`
      - the target docker gets tested after setting up accounts, SSH etc.

Previously, these scripts passed options to each other either by a mix of environment
variables and command-line arguments, with some inconsistencies here and there.

Now, `launch_tests_on_instance.sh` supports a lot of command-line options, which can
be specified directly if testing a remote server, or can be passed-through by the calling
script in case of docker tests. `docker_build_and_run_tests.sh` and
`docker_build_and_run_tests_all.sh` also support to passthrough these options down.
2021-06-25 16:02:38 +02:00
Stéphane Lesimple
d400ceeb9f doc: clush: document --user and --port
Partly fixes #201
2021-06-23 12:24:32 +02:00
Stéphane Lesimple
710b55d845 bump to v3.03.99-rc1 2021-06-03 17:01:10 +02:00
Stéphane Lesimple
2e9fe9288b enh: httpproxy: add options to fine-tune logging
Added the `log_request_response` and `log_request_response_max_size`
options to osh-http-proxy.conf.

By default, requests are logged, including their body, up to a size
of 64K per request response. Before, there was no size limit to the
logged body response.
2021-06-03 16:39:56 +02:00
Stéphane Lesimple
850c8cabd4 fix: freebsd: install script: prefer fetch over curl 2021-06-03 16:16:29 +02:00
Stéphane Lesimple
45cfb78b0b fix: httpproxy: allow more passthrough headers
The following additional header is now allowed to come back from the remote server to the client:
* Content-Length

The following additional headers are now passed through to the remote server:
* Content-Length
* Content-Encoding
2021-06-03 16:16:29 +02:00
Stéphane Lesimple
b364706f37 feat: httpproxy: add functional tests 2021-06-03 16:16:29 +02:00
Stéphane Lesimple
d6291f3ad4 feat: httpproxy: add and use execute_simple() for more performance
Also handle errors better in hand_http_request()
2021-06-03 16:16:29 +02:00
Stéphane Lesimple
4ad41712fd fix: interactive: use load_configuration_file() to handle comments in JSON files 2021-05-27 09:34:37 +02:00
Stéphane Lesimple
17a38ff960 fix: json_load(): remove dead code 2021-05-27 09:34:37 +02:00
Stéphane Lesimple
8cc990ad57 feat: add filtering options to several cmds,nicify print_acls()
The commands selfListAccesses, accountListAccesses,
groupList, groupListServers, groupListGuestAccesses and
accountList now have options to filter their output through
pattern matching, with --include and --exclude.

The output from the commands using print_acls() is also more
human-friendly, with auto-adjusting column length, and empty
columns omitted.

Closes #60.
2021-05-25 09:42:28 +02:00
Stéphane Lesimple
adb9d8c374 feat: add UTF-8 chars to output when supported and allowed
To enhance the readability and visibility of important messages
(such as critical ones). This can be disabled with the `allowUTF8`
global option set to `false`. It's never enabled if the user locale
or their terminal don't seem to support it.
2021-05-24 16:44:35 +02:00
Stéphane Lesimple
f3ce9dfb06 enh: clearer error message on non-existing group 2021-04-08 12:57:47 +02:00
Stéphane Lesimple
2a905aca96 release v3.03.01 2021-03-25 11:55:04 +01:00
Stéphane Lesimple
003052530e feat: preparatory work to support Debian 11 "Bullseye"
We still need to replacee pam_tally2 by pam_faillock
Debian 11 is NOT yet supported, and won't be before it's released as stable.
2021-03-24 17:41:29 +01:00
Stéphane Lesimple
e37e235bf5 enh: install.inc: try harder to hit GitHub API in CI 2021-03-24 10:47:11 +01:00
Stéphane Lesimple
7b7c395c55 enh: osh-orphaned-homedir.sh: add more security checks to ensure we don't archive still-used home dirs 2021-03-19 14:39:31 +01:00
Stéphane Lesimple
7dabfc7135 fix: install-yubico-piv-checker: ppc64le installation was broken 2021-03-17 15:14:13 +01:00
Stéphane Lesimple
89e49ac8b7 fix: add a case to the ignored perl panic race condition 2021-03-01 09:30:30 +01:00
Stéphane Lesimple
b6c7503a73 release v3.03.00 2021-02-22 17:09:12 +01:00
Stéphane Lesimple
3764d652da enh: interactive: avoid a warn() when TERM is undef 2021-02-22 11:56:33 +01:00
Stéphane Lesimple
383f2a011c enh: guests: groupAddGuestAccess now supports setting a comment
If no comment is set, the comment is inherited from the group ACL,
as seen in groupListServers.

selfAddPersonalAccess now also return details
about the added server in the returned JSON.

Closes #18
Closes #17
2021-02-22 11:56:19 +01:00
Stéphane Lesimple
b480316386 fix: groupDelGuestAccess: deleting a guest access returned an error on TTL-forced groups 2021-02-22 11:56:19 +01:00
Stéphane Lesimple
ed77c1ef3e feat: transmit PIV enforcement status to remote realms
Closes #33
2021-02-18 16:05:02 +01:00
Stéphane Lesimple
2327c4dfa1 chore: remove useless '## no critic', perltidy 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
5eb5135d26 doc: update 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
488ec6382e enh: move unexpected-sudo messages from security to code-warning type 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
e760cf6142 feat: add groupGenerateEgressKey and groupDelEgressKey 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
fe58cf1d14 enh: egress ssh key: compute an ID so that keys can be pointed to and deleted 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
c88be2def1 enh: get_group_keys: return the keyhome to avoid hardcoding it on several places 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
02b76d301a fix: groupSetRole: pass sudo param to subfuncs to avoid a security warning 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
4624f71ea2 fix: execute: remove osh_warn on tainted params to avoid exposing arguments on coding error 2021-02-17 10:03:40 +01:00
Stéphane Lesimple
3b37242317 chore: more readable version of sql statements
Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>
2021-02-15 11:25:45 +01:00
Stéphane Lesimple
70feff2c2d enh: install: use in-place overwrite for sudoers files
This fixes a race condition in sudo where it would log a log of
error messages to syslog if used while we're running the install
script: files around sudoers.d/ are then moved around, and it'll
yell for each file it previously listed if the file no longer
exists when it tries to stat() it. It also deprecates the --no-wait
flag of the install script, as now the sudoers.d/ directory will
always have integrity at all times.

Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>
2021-02-14 22:25:50 +01:00
Stéphane Lesimple
59187fcf4c fix: interactive: omit inactivity msg warning when set to 0 seconds
Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>
2021-02-13 16:09:36 +01:00
Stéphane Lesimple
d430c602bf release v3.02.00 2021-02-02 15:02:51 +01:00
Stéphane Lesimple
a913c5aa8a bump to v3.01.99-rc4 2021-01-25 12:18:27 +01:00
Stéphane Lesimple
5d36e820ca fix: admins no longer inherited superowner powers
Regression since rc1
2021-01-25 12:18:04 +01:00
Stéphane Lesimple
3bb1db3a4d bump to v3.01.99-rc3 2021-01-21 15:57:11 +01:00
Stéphane Lesimple
fd97845c1c chore: update autoload list accordingly 2021-01-21 15:56:59 +01:00
Stéphane Lesimple
efe3710e4c feat: groupList/accountList: add --include --exclude 2021-01-21 15:56:59 +01:00
Stéphane Lesimple
80ade2ba4c fix: debian9: create_file_if_not_exists couldn't chgrp by filehanddle 2021-01-20 14:01:55 +01:00
Stéphane Lesimple
69778815bb enh: groupList: use cache to speedup calls
On bastions with thousands of group, the speedup is ~x10
2021-01-20 14:01:55 +01:00